AR
Product
argo-cd
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 12High 22Medium 29Low 0
Watch
Add argo-cd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-23216 | 6.8 | Jan 30 | Argo CD does not scrub secret values from patch errors Affected: >= 2.13.0, < 2.13.4; >= 2.12.0, < 2.12.10; < 2.11.13 |
| CVE-2026-45737 | 6.5 | Jul 15 | Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations Affected: >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2 |
| CVE-2024-41666 | 6.5 | Jul 24 | The Argo CD web terminal session does not handle the revocation of user permissions properly. Affected: >= 2.6.0, < 2.9.21; >= 2.10.0, < 2.10.16; >= 2.11.0, < 2.11.7 |
| CVE-2024-32476 | 6.5 | Apr 26 | Denial of Service via malicious jqPathExpressions in ignoreDifferences Affected: >= 2.10.0, < 2.10.8; >= 2.9.0, < 2.9.13; < 2.8.17 |
| CVE-2024-29893 | 6.5 | Mar 29 | Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server Affected: >= 2.4.0, < 2.8.14; >= 2.9.0, < 2.9.10; >= 2.10.0, < 2.10.5 |
| CVE-2023-40584 | 6.5 | Sep 7 | Argo CD is a declarative continuous deployment for Kubernetes Affected: 2.4.0 before 2.6.15; 2.7.0 before 2.7.14; 2.8.0 before 2.8.3 |
| CVE-2023-25163 | 6.5 | Feb 8 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +2 more |
| CVE-2022-31016 | 6.5 | Jun 25 | Argo CD is a declarative continuous deployment for Kubernetes Affected: 0.7.0 before 2.1.16; 2.2.0 before 2.2.10; 2.3.0 before 2.3.5; 2.4.0 before 2.4.1 |
| CVE-2022-24730 | 6.5 | Mar 23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.3.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2021-3557 | 6.5 | Feb 16 | A flaw was found in argocd Affected: before 1.1.1 |
| CVE-2021-26921 | 6.5 | Feb 9 | In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled Affected: before 1.7.12; 1.8.0 before 1.8.4 |
| CVE-2018-21034 | 6.5 | Apr 9 | In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git Affected: through 1.4.2 |
| CVE-2023-50726 | 6.4 | Mar 13 | Users with `create` but not `override` privileges can perform local sync in argo-cd Affected: >= 1.2.0-rc1, < 2.8.12; >= 2.9.0, < 2.9.8; >= 2.10.0, < 2.10.3 |
| CVE-2024-31990 | 6.3 | Apr 15 | Argo CD' API server does not enforce project sourceNamespaces Affected: >= 2.10.0, < 2.10.7; >= 2.9.0, < 2.9.12; >= 2.4.0, < 2.8.16 |
| CVE-2022-31102 | 6.1 | Jul 12 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.3.0 before 2.3.6; 2.4.0 before 2.4.5 |
| CVE-2021-26924 | 6.1 | Mar 15 | An issue was discovered in Argo CD before 1.8.4 Affected: before 1.7.12; 1.8.0 before 1.8.4 |
| CVE-2021-23135 | 5.5 | May 12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs Affected: 1.7.0 before 1.7.14; 1.8.0 before 1.8.7 |
| CVE-2025-47933 | 5.4 | May 29 | Argo CD allows cross-site scripting on repositories page Affected: >= 1.2.0-rc1, <= 1.8.7; >= 2.0.0-rc3, < 2.13.8; >= 2.14.0-rc1, < 2.14.13; >= 3.0.0-rc1, < 3.0.4 |
| CVE-2024-28175 | 5.4 | Mar 13 | Cross-site scripting on application summary component in argo-cd Affected: >= 1.0.0, < 2.8.12; >= 2.9.0, < 2.9.8; >= 2.10.0, < 2.10.3 |
| CVE-2022-31035 | 5.4 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.0.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2025-55191 | 5.3 | Sep 30 | Repository Credentials Race Condition Crashes Argo CD Server Affected: >= 2.1.0, < 2.14.20; = 3.2.0-rc1; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19 |
| CVE-2020-11576 | 5.3 | Apr 8 | Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because… Affected: 1.5.0 |
| CVE-2022-24731 | 4.9 | Mar 23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.5.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2021-23347 | 4.8 | Mar 3 | The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would… Affected: before 1.7.13; 1.8.0 before 1.8.6 |
| CVE-2024-36106 | 4.3 | Jun 6 | Argo CD allows authenticated users to enumerate clusters by name Affected: > 0.11.0, < 2.9.17; >= 2.10.0, < 2.10.12; >= 2.11.0, < 2.11.3 |
| CVE-2023-40026 | 4.3 | Sep 27 | Argo CD is a declarative continuous deployment framework for Kubernetes Affected: before 2.3.0 |
| CVE-2022-31036 | 4.3 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.3.0 before 2.1.6; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2022-24905 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.6.1 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |
| CVE-2022-24904 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.7.0 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |
Showing 29