Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/argoproj/argo-cd

51 known vulnerabilities (12 critical, 13 high, 18 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v1.8.7 (Mar 3, 2021): affected by 46 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
51 · 12 critical, 13 high, 18 medium, 1 low
Releases
143 since v0.1.0 (Mar 12, 2018)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 51 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 51

  • CVE-2026-77459Critical 9.9

    Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2026-45737Medium 6.3

    Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

    Affected: through 1.8.7; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2026-42880Critical 9.6

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

    Affected: from 1.2.0, through 1.8.7; from 1.2.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

    Affected: from 1.2.0; from 1.2.0, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2025-55191Medium 6.5

    Repository Credentials Race Condition Crashes Argo CD Server

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2025-55190Critical 10.0

    Argo CD: Project API Token Exposes Repository Credentials

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2025-47933Critical 9.1

    Argo CD allows cross-site scripting on repositories page

    Affected: from 1.2.0-rc1, through 1.8.7; from 1.2.0-rc1.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2025-23216Medium 6.8

    Argo CD does not scrub secret values from patch errors

    Affected: through 1.8.7; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-41666Medium 4.7

    The Argo CD web terminal session does not handle the revocation of user permissions properly.

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

    Affected: from 1.0.0; from 1.0.0, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

Show all 51 advisoriesShow fewer advisories
  • CVE-2024-37152Medium 5.3

    Unauthenticated Access to sensitive settings in Argo CD

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-36106Medium 4.3

    Argo CD allows authenticated users to enumerate clusters by name

    Affected: from 0.11.0, fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3; from 0.11.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-31989Critical 9.1

    ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

    Affected: through 1.8.7; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-32476Medium 6.5

    Denial of Service via malicious jqPathExpressions in ignoreDifferences

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-31990Medium 4.8

    Argo CD' API server does not enforce project sourceNamespaces

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

    Affected: through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-50726Medium 6.4

    Users with `create` but not `override` privileges can perform local sync in argo-cd

    Affected: from 1.2.0-rc1; from 1.2.0-rc1, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2024-28175Critical 9.1

    Cross-site scripting on application summary component in argo-cd

    Affected: from 1.0.0; from 1.0.0, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

    Affected: from 0.1.0, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-40026Medium 5.0

    Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

    Affected: all versions; through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-40584Medium 6.5

    Denial of Service to Argo CD repo-server

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-40029Critical 9.9

    Cluster secret might leak in cluster details page in Argo CD

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-40025Medium 4.7

    Argo CD web terminal session doesn't expire

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

    Affected: from 0.5.0; from 0.5.0, through 1.8.7.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-23947Critical 9.1

    Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

    Affected: all versions; from 2.3.0, fixed in 2.3.17; from 2.4.0, fixed in 2.4.23; from 2.5.0, fixed in 2.5.11; from 2.6.0, fixed in 2.6.2.

    No fix released. The latest release, v1.8.7, is still affected.

  • argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2023-22482Critical 9.1

    JWT audience claim is not verified

    Affected: from 1.8.2, fixed in 2.3.14; from 2.4.0, fixed in 2.4.20; from 2.5.0, fixed in 2.5.8; from 2.6.0-rc1, fixed in 2.6.0-rc5; from 1.8.2.

    No fix released. The latest release, v1.8.7, is still affected.

  • Cross-site Scripting for Argo CD single sign on users

    Affected: from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD's certificate verification is skipped for connections to OIDC providers

    Affected: from 0.4.0, fixed in 2.2.11; from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5; from 0.4.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to…

    Affected: from 0.5.0, through 1.8.7; from 0.5.0, fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; from 0.5.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-31036Medium 4.3

    Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

    Affected: from 1.3.0, fixed in 2.1.16; from 1.3.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-31035Critical 9.0

    External URLs for Deployments can include javascript in argo-cd

    Affected: from 1.0.0, fixed in 2.1.16; from 1.0.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • Insecure entropy in argo-cd

    Affected: from 0.11.0, fixed in 2.1.16; from 0.11.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-31016Medium 6.5

    Argo CD vulnerable to Uncontrolled Memory Consumption

    Affected: from 0.7.0, fixed in 2.1.16; from 0.7.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-29165Critical 10.0

    Argo CD will blindly trust JWT claims if anonymous access is enabled

    Affected: fixed in 2.1.15; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-24905Medium 4.3

    Argo CD login screen allows message spoofing if SSO is enabled

    Affected: all versions; fixed in 2.1.15.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-24904Medium 4.3

    Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

    Affected: all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-24768Critical 9.9

    Improper access control allows admin privilege escalation in Argo CD

    Affected: from 0.5.0, through 1.8.7; from 0.5.0, fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; from 0.5.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2022-24731Medium 6.8

    Path traversal allows leaking out-of-bound files from Argo CD repo-server

    Affected: from 1.5.0; from 1.5.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

    Affected: from 1.3.0; from 1.3.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.

    No fix released. The latest release, v1.8.7, is still affected.

  • Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in…

    Affected: fixed in 2.1.9; all versions.

    No fix released. The latest release, v1.8.7, is still affected.

  • CVE-2021-23347Medium 4.7

    Cross-site Scripting (XSS)

    Affected: fixed in 1.7.13; from 1.8.0, fixed in 1.8.6.

    Fixed in v1.7.13 (released Feb 26, 2021, 5 days before disclosure) and v1.8.6 (released Feb 26, 2021, 5 days before disclosure).

    The latest release, v1.8.7, is not affected.

  • In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other…

    Affected: fixed in 1.5.0-rc1.

    Fixed in v1.5.0-rc1 (released Mar 20, 2020, 20 days before disclosure).

    The latest release, v1.8.7, is not affected.

  • As of v1.5.0, the default admin password is set to the argocd-server pod name.

    Affected: through 1.8.0.

    Fixed in v1.8.1 (released Dec 10, 2020, 246 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v1.8.7, is not affected.

  • As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce…

    Affected: fixed in 1.5.1.

    Fixed in v1.5.1 (released Apr 6, 2020, 2 days before disclosure).

    The latest release, v1.8.7, is not affected.

  • Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames…

    Affected: from 1.5.0, fixed in 1.5.1; from 1.5.0, fixed in 1.5.1.

    Fixed in v1.5.1 (released Apr 6, 2020, 2 days before disclosure).

    The latest release, v1.8.7, is not affected.