# github.com/argoproj/argo-cd (Go) vulnerabilities

51 known vulnerabilities (12 critical, 13 high, 18 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v1.8.7 (Mar 3, 2021): affected by 46 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 143 since v0.1.0 (Mar 12, 2018)
- Registry: https://pkg.go.dev/github.com/argoproj/argo-cd
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-77459: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2026-55797: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2026-45737: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2026-45738: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2026-42880: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2026-43824: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2025-59538: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2025-59537: v1.2.0 to v1.8.7 (through the newest release)
- CVE-2025-59531: v1.2.0 to v1.8.7 (through the newest release)
- CVE-2025-55191: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2025-55190: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2025-47933: v1.2.0-rc1 to v1.8.7 (through the newest release)
- CVE-2025-23216: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-41666: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-40634: v1.0.0 to v1.8.7 (through the newest release)
- CVE-2024-37152: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-36106: v0.11.0 to v1.8.7 (through the newest release)
- CVE-2024-31989: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-32476: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-31990: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2024-21661: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-50726: v1.2.0-rc1 to v1.8.7 (through the newest release)
- CVE-2024-28175: v1.0.0 to v1.8.7 (through the newest release)
- CVE-2024-22424: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-40026: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-40584: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-40029: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-40025: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2022-41354: v0.5.0 to v1.8.7 (through the newest release)
- CVE-2023-23947: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-22736: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2023-22482: v1.8.2 to v1.8.7 (through the newest release)
- CVE-2022-31102: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2022-31105: v0.4.0 to v1.8.7 (through the newest release)
- CVE-2022-1025: v0.5.0 to v1.8.7 (through the newest release)
- CVE-2022-31036: v1.3.0 to v1.8.7 (through the newest release)
- CVE-2022-31035: v1.0.0 to v1.8.7 (through the newest release)
- CVE-2022-31034: v0.11.0 to v1.8.7 (through the newest release)
- CVE-2022-31016: v0.7.0 to v1.8.7 (through the newest release)
- CVE-2022-29165: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2022-24905: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2022-24904: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2022-24768: v0.5.0 to v1.8.7 (through the newest release)
- CVE-2022-24731: v1.5.0 to v1.8.7 (through the newest release)
- CVE-2022-24730: v1.3.0 to v1.8.7 (through the newest release)
- CVE-2022-24348: v0.1.0 to v1.8.7 (through the newest release)
- CVE-2021-23347: v0.1.0 to v1.7.12 (v1.7.13 is outside it); v1.8.0 to v1.8.5 (v1.8.6 is outside it)
- CVE-2018-21034: v0.1.0 to v1.4.3 (v1.5.0-rc1 is outside it)
- CVE-2020-8828: v0.1.0 to v1.8.0 (v1.8.1 is outside it)
- CVE-2020-8827: v0.1.0 to v1.5.0 (v1.5.1 is outside it)
- CVE-2020-11576: v1.5.0 (v1.5.1 is outside it)

## Advisories (51)

### [CVE-2026-77459](https://cve.now/CVE-2026-77459): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

- Severity: Critical 9.9
- Published: Oct 13, 2026
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2026-55797](https://cve.now/CVE-2026-55797): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

- Severity: High 8.8
- Published: Oct 9, 2026
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2026-45737](https://cve.now/CVE-2026-45737): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

- Severity: Medium 6.3
- Published: Jul 15, 2026
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2026-45738](https://cve.now/CVE-2026-45738): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

- Severity: High 7.3
- Published: Jul 15, 2026
- Affected: through 1.8.7; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2026-42880](https://cve.now/CVE-2026-42880): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

- Severity: Critical 9.6
- Published: May 7, 2026
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2026-43824](https://cve.now/CVE-2026-43824): In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

- Severity: High 7.7
- Published: May 2, 2026
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-59538](https://cve.now/CVE-2025-59538): Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-59537](https://cve.now/CVE-2025-59537): argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: from 1.2.0, through 1.8.7; from 1.2.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-59531](https://cve.now/CVE-2025-59531): Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: from 1.2.0; from 1.2.0, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-55191](https://cve.now/CVE-2025-55191): Repository Credentials Race Condition Crashes Argo CD Server

- Severity: Medium 6.5
- Published: Sep 30, 2025
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-55190](https://cve.now/CVE-2025-55190): Argo CD: Project API Token Exposes Repository Credentials

- Severity: Critical 10.0
- Published: Sep 4, 2025
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-47933](https://cve.now/CVE-2025-47933): Argo CD allows cross-site scripting on repositories page

- Severity: Critical 9.1
- Published: May 29, 2025
- Affected: from 1.2.0-rc1, through 1.8.7; from 1.2.0-rc1.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2025-23216](https://cve.now/CVE-2025-23216): Argo CD does not scrub secret values from patch errors

- Severity: Medium 6.8
- Published: Jan 30, 2025
- Affected: through 1.8.7; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-41666](https://cve.now/CVE-2024-41666): The Argo CD web terminal session does not handle the revocation of user permissions properly.

- Severity: Medium 4.7
- Published: Jul 24, 2024
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-40634](https://cve.now/CVE-2024-40634): Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

- Severity: High 7.5
- Published: Jul 22, 2024
- Affected: from 1.0.0; from 1.0.0, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-37152](https://cve.now/CVE-2024-37152): Unauthenticated Access to sensitive settings in Argo CD

- Severity: Medium 5.3
- Published: Jun 6, 2024
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-36106](https://cve.now/CVE-2024-36106): Argo CD allows authenticated users to enumerate clusters by name

- Severity: Medium 4.3
- Published: Jun 6, 2024
- Affected: from 0.11.0, fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3; from 0.11.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-31989](https://cve.now/CVE-2024-31989): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

- Severity: Critical 9.1
- Published: May 21, 2024
- Affected: through 1.8.7; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-32476](https://cve.now/CVE-2024-32476): Denial of Service via malicious jqPathExpressions in ignoreDifferences

- Severity: Medium 6.5
- Published: Apr 26, 2024
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-31990](https://cve.now/CVE-2024-31990): Argo CD' API server does not enforce project sourceNamespaces

- Severity: Medium 4.8
- Published: Apr 15, 2024
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-21661](https://cve.now/CVE-2024-21661): Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

- Severity: High 7.5
- Published: Mar 18, 2024
- Affected: through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-50726](https://cve.now/CVE-2023-50726): Users with \`create\` but not \`override\` privileges can perform local sync in argo-cd

- Severity: Medium 6.4
- Published: Mar 13, 2024
- Affected: from 1.2.0-rc1; from 1.2.0-rc1, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-28175](https://cve.now/CVE-2024-28175): Cross-site scripting on application summary component in argo-cd

- Severity: Critical 9.1
- Published: Mar 13, 2024
- Affected: from 1.0.0; from 1.0.0, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2024-22424](https://cve.now/CVE-2024-22424): Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

- Severity: High 8.4
- Published: Jan 19, 2024
- Affected: from 0.1.0, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-40026](https://cve.now/CVE-2023-40026): Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

- Severity: Medium 5.0
- Published: Sep 27, 2023
- Affected: all versions; through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-40584](https://cve.now/CVE-2023-40584): Denial of Service to Argo CD repo-server

- Severity: Medium 6.5
- Published: Sep 7, 2023
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-40029](https://cve.now/CVE-2023-40029): Cluster secret might leak in cluster details page in Argo CD

- Severity: Critical 9.9
- Published: Sep 7, 2023
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-40025](https://cve.now/CVE-2023-40025): Argo CD web terminal session doesn't expire

- Severity: Medium 4.7
- Published: Aug 23, 2023
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-41354](https://cve.now/CVE-2022-41354): An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

- Severity: Unrated
- Published: Mar 27, 2023
- Affected: from 0.5.0; from 0.5.0, through 1.8.7.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-23947](https://cve.now/CVE-2023-23947): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

- Severity: Critical 9.1
- Published: Feb 16, 2023
- Affected: all versions; from 2.3.0, fixed in 2.3.17; from 2.4.0, fixed in 2.4.23; from 2.5.0, fixed in 2.5.11; from 2.6.0, fixed in 2.6.2.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-22736](https://cve.now/CVE-2023-22736): argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

- Severity: High 8.6
- Published: Jan 26, 2023
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2023-22482](https://cve.now/CVE-2023-22482): JWT audience claim is not verified

- Severity: Critical 9.1
- Published: Jan 25, 2023
- Affected: from 1.8.2, fixed in 2.3.14; from 2.4.0, fixed in 2.4.20; from 2.5.0, fixed in 2.5.8; from 2.6.0-rc1, fixed in 2.6.0-rc5; from 1.8.2.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31102](https://cve.now/CVE-2022-31102): Cross-site Scripting for Argo CD single sign on users

- Severity: Low 2.6
- Published: Jul 12, 2022
- Affected: from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31105](https://cve.now/CVE-2022-31105): Argo CD's certificate verification is skipped for connections to OIDC providers

- Severity: High 8.3
- Published: Jul 12, 2022
- Affected: from 0.4.0, fixed in 2.2.11; from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5; from 0.4.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-1025](https://cve.now/CVE-2022-1025): All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to…

- Severity: Unrated
- Published: Jul 12, 2022
- Affected: from 0.5.0, through 1.8.7; from 0.5.0, fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; from 0.5.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31036](https://cve.now/CVE-2022-31036): Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

- Severity: Medium 4.3
- Published: Jun 27, 2022
- Affected: from 1.3.0, fixed in 2.1.16; from 1.3.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31035](https://cve.now/CVE-2022-31035): External URLs for Deployments can include javascript in argo-cd

- Severity: Critical 9.0
- Published: Jun 27, 2022
- Affected: from 1.0.0, fixed in 2.1.16; from 1.0.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31034](https://cve.now/CVE-2022-31034): Insecure entropy in argo-cd

- Severity: High 8.3
- Published: Jun 27, 2022
- Affected: from 0.11.0, fixed in 2.1.16; from 0.11.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-31016](https://cve.now/CVE-2022-31016): Argo CD vulnerable to Uncontrolled Memory Consumption

- Severity: Medium 6.5
- Published: Jun 25, 2022
- Affected: from 0.7.0, fixed in 2.1.16; from 0.7.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-29165](https://cve.now/CVE-2022-29165): Argo CD will blindly trust JWT claims if anonymous access is enabled

- Severity: Critical 10.0
- Published: May 20, 2022
- Affected: fixed in 2.1.15; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24905](https://cve.now/CVE-2022-24905): Argo CD login screen allows message spoofing if SSO is enabled

- Severity: Medium 4.3
- Published: May 20, 2022
- Affected: all versions; fixed in 2.1.15.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24904](https://cve.now/CVE-2022-24904): Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

- Severity: Medium 4.3
- Published: May 20, 2022
- Affected: all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24768](https://cve.now/CVE-2022-24768): Improper access control allows admin privilege escalation in Argo CD

- Severity: Critical 9.9
- Published: Mar 23, 2022
- Affected: from 0.5.0, through 1.8.7; from 0.5.0, fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; from 0.5.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24731](https://cve.now/CVE-2022-24731): Path traversal allows leaking out-of-bound files from Argo CD repo-server

- Severity: Medium 6.8
- Published: Mar 23, 2022
- Affected: from 1.5.0; from 1.5.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24730](https://cve.now/CVE-2022-24730): Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

- Severity: High 7.7
- Published: Mar 23, 2022
- Affected: from 1.3.0; from 1.3.0, fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2022-24348](https://cve.now/CVE-2022-24348): Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in…

- Severity: Unrated
- Published: Feb 4, 2022
- Affected: fixed in 2.1.9; all versions.
- No fix released. The latest release, v1.8.7, is still affected.

### [CVE-2021-23347](https://cve.now/CVE-2021-23347): Cross-site Scripting (XSS)

- Severity: Medium 4.7
- Published: Mar 3, 2021
- Affected: fixed in 1.7.13; from 1.8.0, fixed in 1.8.6.
- Fixed in v1.7.13 (released Feb 26, 2021, 5 days before disclosure) and v1.8.6 (released Feb 26, 2021, 5 days before disclosure).
- The latest release, v1.8.7, is not affected.

### [CVE-2018-21034](https://cve.now/CVE-2018-21034): In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other…

- Severity: Unrated
- Published: Apr 9, 2020
- Affected: fixed in 1.5.0-rc1.
- Fixed in v1.5.0-rc1 (released Mar 20, 2020, 20 days before disclosure).
- The latest release, v1.8.7, is not affected.

### [CVE-2020-8828](https://cve.now/CVE-2020-8828): As of v1.5.0, the default admin password is set to the argocd-server pod name.

- Severity: Unrated
- Published: Apr 8, 2020
- Affected: through 1.8.0.
- Fixed in v1.8.1 (released Dec 10, 2020, 246 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, v1.8.7, is not affected.

### [CVE-2020-8827](https://cve.now/CVE-2020-8827): As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce…

- Severity: Unrated
- Published: Apr 8, 2020
- Affected: fixed in 1.5.1.
- Fixed in v1.5.1 (released Apr 6, 2020, 2 days before disclosure).
- The latest release, v1.8.7, is not affected.

### [CVE-2020-11576](https://cve.now/CVE-2020-11576): Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames…

- Severity: Unrated
- Published: Apr 8, 2020
- Affected: from 1.5.0, fixed in 1.5.1; from 1.5.0, fixed in 1.5.1.
- Fixed in v1.5.1 (released Apr 6, 2020, 2 days before disclosure).
- The latest release, v1.8.7, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/argoproj/argo-cd
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.