Login Request a demo
AR
Product
argo-cd
by argoproj · last CVE Oct 20, 2026
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities63In the news0Timeline
Severity mix
Critical 12High 22Medium 29Low 0
Severity
All severities63Critical12High22Medium29Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add argo-cd to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-29165
10.0
2%
May 20
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.4.0 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4
CVE-2026-113709
9.9
1%
Oct 20
Argo CD: A Kustomize Helm config home can run commands in the repo-server
Affected: >= 2.1.0, < 3.3.15; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-113708
9.9
1%
Oct 20
Argo CD: A Kustomize remote ref can run commands in the repo-server
Affected: >= 2.7.0, < 3.3.15; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-113672
9.9
1%
Oct 20
Argo CD: A Jsonnet import can read files from the repo-server
Affected: >= 0.9.0, < 3.3.1; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-77459
9.9
0%
Oct 13
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Affected: >= 2.10.0, <= 2.14.21; >= 3.0.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2025-55190
9.9
6%
Sep 4
Argo CD: Project API Token Exposes Repository Credentials
Affected: >= 2.13.0, < 2.13.9; >= 2.14.0, < 2.14.16; >= 3.0.0, < 3.0.14; >= 3.1.0-rc1, < 3.1.2
CVE-2024-21652
9.8
1%
Mar 18
Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Affected: < 2.8.13; >= 2.9.0, < 2.9.9; >= 2.10.0, < 2.10.4
CVE-2026-42880
9.6
1%
May 7
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Affected: >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9
CVE-2023-40029
9.6
1%
Sep 7
Argo CD is a declarative continuous deployment for Kubernetes
Affected: 2.2.0 before 2.6.15; 2.7.0 before 2.7.14; 2.8.0 before 2.8.3
CVE-2022-31105
9.6
1%
Jul 12
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.3.0 before 2.3.6; 2.4.0 before 2.4.5
CVE-2024-21662
9.1
1%
Mar 18
Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
Affected: < 2.8.13; >= 2.9.0, < 2.9.9; >= 2.10.0, < 2.10.4
CVE-2024-31989
9.0
1%
May 21
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
Affected: < 2.8.19; >= 2.9.0-rc1, < 2.9.15; >= 2.10.0-rc1, < 2.10.10; >= 2.11.0-rc1, < 2.11.1; <= 1.8.7
Showing 12