GoPackage

github.com/argoproj/argo-cd/v2

51 known vulnerabilities (13 critical, 14 high, 20 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v2.14.21 (Nov 4, 2025): affected by 6 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 51 · 13 critical, 14 high, 20 medium, 1 low

Releases: 337 since v2.0.0 (Apr 7, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-77459
Affects v2.10.0 to v2.14.21 (through the newest release)
CVE-2026-55797
Affects v2.11.0 to v2.14.21 (through the newest release)
CVE-2026-45737
Affects v2.0.0-rc3 to v2.14.21 (through the newest release)
CVE-2026-45738
Affects v2.0.0-rc3 to v2.14.21 (through the newest release)
CVE-2026-42880
Affects v2.0.0-rc3 to v2.14.21 (through the newest release)
CVE-2026-43824
Affects v2.0.0-rc3 to v2.14.21 (through the newest release)
CVE-2025-59538
Affects v2.9.0-rc1 to v2.14.19 (v2.14.20 is outside it)
CVE-2025-59537
Affects v2.0.0-rc3 to v2.14.19 (v2.14.20 is outside it)
CVE-2025-59531
Affects v2.0.0-rc3 to v2.14.19 (v2.14.20 is outside it)
CVE-2025-55191
Affects v2.1.0 to v2.14.19 (v2.14.20 is outside it)
CVE-2025-55190
Affects v2.13.0 to v2.13.8 (v2.13.9 is outside it); v2.14.0 to v2.14.15 (v2.14.16 is outside it)
CVE-2025-47933
Affects v2.0.0-rc3 to v2.13.7 (v2.13.8 is outside it); v2.14.0-rc1 to v2.14.12 (v2.14.13 is outside it)

Show all 51 advisoriesShow fewer advisories

CVE-2025-23216
Affects v2.0.0-rc3 to v2.11.12 (v2.11.13 is outside it); v2.12.0 to v2.12.9 (v2.12.10 is outside it); v2.13.0 to v2.13.3 (v2.13.4 is outside it)
CVE-2024-41666
Affects v2.6.0 to v2.9.20 (v2.9.21 is outside it); v2.10.0 to v2.10.15 (v2.10.16 is outside it); v2.11.0 to v2.11.6 (v2.11.7 is outside it)
CVE-2024-40634
Affects v2.0.0-rc3 to v2.9.19 (v2.9.20 is outside it); v2.10.0 to v2.10.14 (v2.10.15 is outside it); v2.11.0 to v2.11.5 (v2.11.6 is outside it)
CVE-2024-37152
Affects v2.9.3 to v2.9.16 (v2.9.17 is outside it); v2.10.0 to v2.10.11 (v2.10.12 is outside it); v2.11.0 to v2.11.2 (v2.11.3 is outside it)
CVE-2024-36106
Affects v2.0.0-rc3 to v2.9.16 (v2.9.17 is outside it); v2.10.0 to v2.10.11 (v2.10.12 is outside it); v2.11.0 to v2.11.2 (v2.11.3 is outside it)
CVE-2024-31989
Affects v2.0.0-rc3 to v2.8.18 (v2.8.19 is outside it); v2.9.0-rc1 to v2.9.14 (v2.9.15 is outside it); v2.10.0-rc1 to v2.10.9 (v2.10.10 is outside it); v2.11.0-rc1 to v2.11.0 (v2.11.1 is outside it)
CVE-2024-32476
Affects v2.0.0-rc3 to v2.8.16 (v2.8.17 is outside it); v2.9.0 to v2.9.12 (v2.9.13 is outside it); v2.10.0 to v2.10.7 (v2.10.8 is outside it)
CVE-2024-31990
Affects v2.4.0 to v2.8.15 (v2.8.16 is outside it); v2.9.0 to v2.9.11 (v2.9.12 is outside it); v2.10.0 to v2.10.6 (v2.10.7 is outside it)
CVE-2024-29893
Affects v2.4.0 to v2.8.13 (v2.8.14 is outside it); v2.9.0 to v2.9.9 (v2.9.10 is outside it); v2.10.0 to v2.10.4 (v2.10.5 is outside it)
CVE-2024-21662
Affects v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
CVE-2024-21661
Affects v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
CVE-2024-21652
Affects v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
CVE-2023-50726
Affects v2.0.0-rc3 to v2.8.11 (v2.8.12 is outside it); v2.9.0 to v2.9.7 (v2.9.8 is outside it); v2.10.0 to v2.10.2 (v2.10.3 is outside it)
CVE-2024-28175
Affects v2.0.0 to v2.8.11 (v2.8.12 is outside it); v2.9.0 to v2.9.7 (v2.9.8 is outside it); v2.10.0 to v2.10.2 (v2.10.3 is outside it)
CVE-2024-22424
Affects v2.0.0-rc3 to v2.7.15 (v2.7.16 is outside it); v2.8.0-rc1 to v2.8.7 (v2.8.8 is outside it); v2.9.0-rc1 to v2.9.3 (v2.9.4 is outside it); v2.10.0-rc1 (v2.10.0-rc2 is outside it)
CVE-2023-40026
Affects v2.0.0-rc3 to v2.3.0-rc5 (v2.3.0 is outside it)
CVE-2023-40584
Affects v2.4.0 to v2.6.14 (v2.6.15 is outside it); v2.7.0 to v2.7.13 (v2.7.14 is outside it); v2.8.0 to v2.8.2 (v2.8.3 is outside it)
CVE-2023-40029
Affects v2.2.0 to v2.6.14 (v2.6.15 is outside it); v2.7.0 to v2.7.13 (v2.7.14 is outside it); v2.8.0 to v2.8.2 (v2.8.3 is outside it)
CVE-2023-40025
Affects v2.6.0 to v2.6.13 (v2.6.14 is outside it); v2.7.0 to v2.7.11 (v2.7.12 is outside it); v2.8.0 (v2.8.1 is outside it)
CVE-2022-41354
Affects v2.0.0-rc3 to v2.4.27 (v2.4.28 is outside it); v2.5.0 to v2.5.15 (v2.5.16 is outside it); v2.6.0 to v2.6.6 (v2.6.7 is outside it)
CVE-2023-23947
Affects v2.3.0 to v2.3.16 (v2.3.17 is outside it); v2.4.0 to v2.4.22 (v2.4.23 is outside it); v2.5.0 to v2.5.10 (v2.5.11 is outside it); v2.6.0 to v2.6.1 (v2.6.2 is outside it)
CVE-2023-25163
Affects v2.6.0-rc1 to v2.6.0 (v2.6.1 is outside it)
CVE-2023-22736
Affects v2.5.0-rc1 to v2.5.7 (v2.5.8 is outside it); v2.6.0-rc4 (v2.6.0-rc5 is outside it)
CVE-2023-22482
Affects v2.0.0-rc3 to v2.3.13 (v2.3.14 is outside it); v2.4.0 to v2.4.19 (v2.4.20 is outside it); v2.5.0 to v2.5.7 (v2.5.8 is outside it); v2.6.0-rc1 to v2.6.0-rc4 (v2.6.0-rc5 is outside it)
CVE-2022-31102
Affects v2.3.0 to v2.3.5 (v2.3.6 is outside it); v2.4.0 to v2.4.4 (v2.4.5 is outside it)
CVE-2022-31105
Affects v2.0.0-rc3 to v2.2.10 (v2.2.11 is outside it); v2.3.0 to v2.3.5 (v2.3.6 is outside it); v2.4.0 to v2.4.4 (v2.4.5 is outside it)
CVE-2022-1025
Affects v2.0.0-rc3 to v2.1.13 (v2.1.14 is outside it); v2.2.0 to v2.2.8-1 (v2.2.8 is outside it); v2.3.0 to v2.3.1 (v2.3.2 is outside it)
CVE-2022-31036
Affects v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
CVE-2022-31035
Affects v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
CVE-2022-31034
Affects v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
CVE-2022-31016
Affects v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
CVE-2022-29165
Affects v2.0.0-rc3 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
CVE-2022-24905
Affects v2.0.0 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
CVE-2022-24904
Affects v2.0.0-rc3 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
CVE-2022-24768
Affects v2.0.0-rc3 to v2.1.13 (v2.1.14 is outside it); v2.2.0 to v2.2.8-1 (v2.2.8 is outside it); v2.3.0 to v2.3.1 (v2.3.2 is outside it)
CVE-2022-24731
Affects v2.0.0-rc3 to v2.1.10 (v2.1.11 is outside it); v2.2.0 to v2.2.5 (v2.2.6 is outside it); v2.3.0-rc1 to v2.3.0-rc5 (v2.3.0 is outside it)
CVE-2022-24730
Affects v2.0.0-rc3 to v2.1.10 (v2.1.11 is outside it); v2.2.0 to v2.2.5 (v2.2.6 is outside it); v2.3.0-rc1 to v2.3.0-rc5 (v2.3.0 is outside it)
CVE-2022-24348
Affects v2.0.0-rc3 to v2.1.8 (v2.1.9 is outside it); v2.2.0 to v2.2.3 (v2.2.4 is outside it)
CVE-2021-23347
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 51

CVE-2026-77459Critical 9.9
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Affected: from 2.10.0, through 2.14.21; from 2.10.0.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2026-55797High 8.8
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Affected: from 2.11.0, through 2.14.21; from 2.11.0.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2026-45737Medium 6.3
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Affected: all versions.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2026-45738High 7.3
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Affected: through 2.14.21; all versions.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2026-42880Critical 9.6
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Affected: all versions.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2026-43824High 7.7
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
Affected: all versions.
No fix released. The latest release, v2.14.21, is still affected.
CVE-2025-59538High 7.5
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Affected: from 2.9.0-rc1, fixed in 2.14.20.
Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-59537High 7.5
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
Affected: from 2.0.0-rc1, fixed in 2.14.20; fixed in 2.14.20.
Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-59531High 7.5
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Affected: fixed in 2.14.20; from 2.0.0-rc1, fixed in 2.14.20.
Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-55191Medium 6.5
Repository Credentials Race Condition Crashes Argo CD Server
Affected: from 2.1.0, fixed in 2.14.20.
Fixed in v2.14.20 (released Sep 30, 2025, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-55190Critical 10.0
Argo CD: Project API Token Exposes Repository Credentials
Affected: from 2.13.0, fixed in 2.13.9; from 2.14.0, fixed in 2.14.16; from 2.13.0, fixed in 2.13.9; from 2.14.0, fixed in 2.14.16.
Fixed in v2.13.9 (released Sep 4, 2025, the day of disclosure) and v2.14.16 (released Sep 4, 2025, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-47933Critical 9.1
Argo CD allows cross-site scripting on repositories page
Affected: from 2.0.0-rc3, fixed in 2.13.8; from 2.14.0-rc1, fixed in 2.14.13; from 2.0.0-rc3, fixed in 2.13.8; from 2.14.0-rc1, fixed in 2.14.13.
Fixed in v2.13.8 (released May 28, 2025, 1 day before disclosure) and v2.14.13 (released May 28, 2025, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2025-23216Medium 6.8
Argo CD does not scrub secret values from patch errors
Affected: from 2.13.0, fixed in 2.13.4; from 2.12.0, fixed in 2.12.10; fixed in 2.11.13; fixed in 2.11.13; from 2.12.0, fixed in 2.12.10; from 2.13.0, fixed in 2.13.4.
Fixed in v2.11.13 (released Jan 29, 2025, 1 day before disclosure), v2.12.10 (released Jan 29, 2025, 1 day before disclosure) and v2.13.4 (released Jan 29, 2025, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-41666Medium 4.7
The Argo CD web terminal session does not handle the revocation of user permissions properly.
Affected: from 2.6.0, fixed in 2.9.21; from 2.10.0, fixed in 2.10.16; from 2.11.0, fixed in 2.11.7; from 2.6.0, fixed in 2.9.21; from 2.10.0, fixed in 2.10.16; from 2.11.0, fixed in 2.11.7.
Fixed in v2.9.21 (released Jul 24, 2024, the day of disclosure), v2.10.16 (released Jul 24, 2024, the day of disclosure) and v2.11.7 (released Jul 24, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-40634High 7.5
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
Affected: fixed in 2.9.20; from 2.10.0, fixed in 2.10.15; from 2.11.0, fixed in 2.11.6; fixed in 2.9.20; from 2.10.0, fixed in 2.10.15; from 2.11.0, fixed in 2.11.6.
Fixed in v2.9.20 (released Jul 22, 2024, the day of disclosure), v2.10.15 (released Jul 22, 2024, the day of disclosure) and v2.11.6 (released Jul 22, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.

Show all 51 advisoriesShow fewer advisories

CVE-2024-37152Medium 5.3
Unauthenticated Access to sensitive settings in Argo CD
Affected: from 2.9.3, fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3.
Fixed in v2.9.17 (released Jun 6, 2024, the day of disclosure), v2.10.12 (released Jun 6, 2024, the day of disclosure) and v2.11.3 (released Jun 6, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-36106Medium 4.3
Argo CD allows authenticated users to enumerate clusters by name
Affected: fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3.
Fixed in v2.9.17 (released Jun 6, 2024, the day of disclosure), v2.10.12 (released Jun 6, 2024, the day of disclosure) and v2.11.3 (released Jun 6, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-31989Critical 9.1
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
Affected: fixed in 2.8.19; from 2.9.0-rc1, fixed in 2.9.15; from 2.10.0-rc1, fixed in 2.10.10; from 2.11.0-rc1, fixed in 2.11.1; fixed in 2.8.19; from 2.9.0-rc1, fixed in 2.9.15; from 2.10.0-rc1, fixed in 2.10.10; from 2.11.0-rc1, fixed in 2.11.1.
Fixed in v2.8.19 (released May 21, 2024, the day of disclosure), v2.9.15 (released May 21, 2024, the day of disclosure), v2.10.10 (released May 21, 2024, the day of disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2024-32476Medium 6.5
Denial of Service via malicious jqPathExpressions in ignoreDifferences
Affected: fixed in 2.8.17; from 2.9.0, fixed in 2.9.13; from 2.10.0, fixed in 2.10.8; from 2.10.0, fixed in 2.10.8; from 2.9.0, fixed in 2.9.13; fixed in 2.8.17.
Fixed in v2.8.17 (released Apr 26, 2024, the day of disclosure), v2.9.13 (released Apr 26, 2024, the day of disclosure) and v2.10.8 (released Apr 26, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-31990Medium 4.8
Argo CD' API server does not enforce project sourceNamespaces
Affected: from 2.4.0, fixed in 2.8.16; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.7; from 2.4.0, fixed in 2.8.16; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.7.
Fixed in v2.8.16 (released Apr 15, 2024, the day of disclosure), v2.9.12 (released Apr 15, 2024, the day of disclosure) and v2.10.7 (released Apr 15, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-29893Medium 6.5
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
Affected: from 2.4.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.5; from 2.4.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.5.
Fixed in v2.8.14 (released Mar 28, 2024, 1 day before disclosure), v2.9.10 (released Mar 28, 2024, 1 day before disclosure) and v2.10.5 (released Mar 28, 2024, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-21662High 7.5
Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-21661High 7.5
Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-21652Critical 9.8
Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-50726Medium 6.4
Users with `create` but not `override` privileges can perform local sync in argo-cd
Affected: from 2.0.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.0.0-rc3, fixed in 2.8.12.
Fixed in v2.8.12 (released Mar 13, 2024, the day of disclosure), v2.9.8 (released Mar 13, 2024, the day of disclosure) and v2.10.3 (released Mar 13, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-28175Critical 9.1
Cross-site scripting on application summary component in argo-cd
Affected: from 2.0.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.0.0, fixed in 2.8.12.
Fixed in v2.8.12 (released Mar 13, 2024, the day of disclosure), v2.9.8 (released Mar 13, 2024, the day of disclosure) and v2.10.3 (released Mar 13, 2024, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2024-22424High 8.4
Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd
Affected: fixed in 2.7.16; from 2.8.0-rc1, fixed in 2.8.8; from 2.9.0-rc1, fixed in 2.9.4; from 2.10.0-rc1, fixed in 2.10-rc2.
Fixed in v2.7.16 (released Jan 19, 2024, the day of disclosure), v2.8.8 (released Jan 19, 2024, the day of disclosure), v2.9.4 (released Jan 18, 2024, 1 day before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2023-40026Medium 5.0
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
Affected: fixed in 2.3.0.
Fixed in v2.3.0 (released Mar 6, 2022, 570 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-40584Medium 6.5
Denial of Service to Argo CD repo-server
Affected: from 2.4.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3; from 2.4.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3.
Fixed in v2.6.15 (released Sep 7, 2023, the day of disclosure), v2.7.14 (released Sep 7, 2023, the day of disclosure) and v2.8.3 (released Sep 7, 2023, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-40029Critical 9.9
Cluster secret might leak in cluster details page in Argo CD
Affected: from 2.2.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3; from 2.2.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3.
Fixed in v2.6.15 (released Sep 7, 2023, the day of disclosure), v2.7.14 (released Sep 7, 2023, the day of disclosure) and v2.8.3 (released Sep 7, 2023, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-40025Medium 4.7
Argo CD web terminal session doesn't expire
Affected: from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.1; from 2.0.0-20230718200744-12a5a7a70d6e, fixed in 2.0.0-20230821201509-e047efa8f951; from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.1.
Fixed in v2.0.0 (released Apr 7, 2021, 868 days before disclosure, the advisory names 2.0.0-20230821201509-e047efa8f951, which was never published), v2.6.14 (released Aug 7, 2023, 16 days before disclosure), v2.7.12 (released Aug 21, 2023, 2 days before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-41354Unrated
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.
Affected: fixed in 2.4.28; from 2.5.0, fixed in 2.5.16; from 2.6.0, fixed in 2.6.7; from 2.5.0, fixed in 2.5.16; from 2.6.0, fixed in 2.6.7; fixed in 2.4.28.
Fixed in v2.4.28 (released Mar 23, 2023, 4 days before disclosure), v2.5.16 (released Mar 23, 2023, 4 days before disclosure) and v2.6.7 (released Mar 23, 2023, 4 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-23947Critical 9.1
Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets
Affected: from 2.3.0, fixed in 2.3.17; from 2.4.0, fixed in 2.4.23; from 2.5.0, fixed in 2.5.11; from 2.6.0, fixed in 2.6.2.
Fixed in v2.3.17 (released Feb 16, 2023, the day of disclosure), v2.4.23 (released Feb 16, 2023, the day of disclosure), v2.5.11 (released Feb 16, 2023, the day of disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2023-25163Medium 6.3
Argo CD leaks repository credentials in user-facing error messages and in logs
Affected: from 2.6.0-rc1, fixed in 2.6.1.
Fixed in v2.6.1 (released Feb 8, 2023, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-22736High 8.6
argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
Affected: from 2.5.0-rc1, fixed in 2.5.8; from 2.6.0-rc4, fixed in 2.6.0-rc5; from 2.5.0-rc1, fixed in 2.5.8; from 2.6.0-rc4, fixed in 2.6.0-rc5.
Fixed in v2.5.8 (released Jan 25, 2023, 1 day before disclosure) and v2.6.0-rc5 (released Jan 25, 2023, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2023-22482Critical 9.1
JWT audience claim is not verified
Affected: fixed in 2.3.14; from 2.4.0, fixed in 2.4.20; from 2.5.0, fixed in 2.5.8; from 2.6.0-rc1, fixed in 2.6.0-rc5.
Fixed in v2.3.14 (released Jan 25, 2023, the day of disclosure), v2.4.20 (released Jan 25, 2023, the day of disclosure), v2.5.8 (released Jan 25, 2023, the day of disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-31102Low 2.6
Cross-site Scripting for Argo CD single sign on users
Affected: from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5.
Fixed in v2.3.6 (released Jul 12, 2022, the day of disclosure) and v2.4.5 (released Jul 12, 2022, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-31105High 8.3
Argo CD's certificate verification is skipped for connections to OIDC providers
Affected: fixed in 2.2.11; from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5.
Fixed in v2.2.11 (released Jul 12, 2022, the day of disclosure), v2.3.6 (released Jul 12, 2022, the day of disclosure) and v2.4.5 (released Jul 12, 2022, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-1025Unrated
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to…
Affected: fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2.
Fixed in v2.1.14 (released Mar 23, 2022, 111 days before disclosure), v2.2.8 (released Mar 23, 2022, 111 days before disclosure) and v2.3.2 (released Mar 23, 2022, 111 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-31036Medium 4.3
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-31035Critical 9.0
External URLs for Deployments can include javascript in argo-cd
Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-31034High 8.3
Insecure entropy in argo-cd
Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-31016Medium 6.5
Argo CD vulnerable to Uncontrolled Memory Consumption
Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
Fixed in v2.1.16 (released Jun 21, 2022, 4 days before disclosure), v2.2.10 (released Jun 21, 2022, 4 days before disclosure), v2.3.5 (released Jun 21, 2022, 4 days before disclosure) and 1 other version.
The latest release, v2.14.21, is not affected.
CVE-2022-29165Critical 10.0
Argo CD will blindly trust JWT claims if anonymous access is enabled
Affected: from 2.3.0, fixed in 2.3.4; from 2.2.0, fixed in 2.2.9; fixed in 2.1.15; fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4.
Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24905Medium 4.3
Argo CD login screen allows message spoofing if SSO is enabled
Affected: from 2.0.0, fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4; from 2.3.0, fixed in 2.3.4; from 2.2.0, fixed in 2.2.9; from 2.0.0, fixed in 2.1.15.
Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24904Medium 4.3
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
Affected: fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4; fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4.
Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24768Critical 9.9
Improper access control allows admin privilege escalation in Argo CD
Affected: fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2.
Fixed in v2.1.14 (released Mar 23, 2022, the day of disclosure), v2.2.8 (released Mar 23, 2022, the day of disclosure) and v2.3.2 (released Mar 23, 2022, the day of disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24731Medium 6.8
Path traversal allows leaking out-of-bound files from Argo CD repo-server
Affected: fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
Fixed in v2.1.11 (released Mar 6, 2022, 17 days before disclosure), v2.2.6 (released Mar 6, 2022, 17 days before disclosure) and v2.3.0 (released Mar 6, 2022, 17 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24730High 7.7
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Affected: fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
Fixed in v2.1.11 (released Mar 6, 2022, 17 days before disclosure), v2.2.6 (released Mar 6, 2022, 17 days before disclosure) and v2.3.0 (released Mar 6, 2022, 17 days before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2022-24348Unrated
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in…
Affected: fixed in 2.1.9; from 2.2.0, fixed in 2.2.4; fixed in 2.1.9; from 2.2.0, fixed in 2.2.4.
Fixed in v2.1.9 (released Feb 3, 2022, 1 day before disclosure) and v2.2.4 (released Feb 3, 2022, 1 day before disclosure).
The latest release, v2.14.21, is not affected.
CVE-2021-23347Medium 4.7
Cross-site Scripting (XSS)
Affected: fixed in 1.7.13; from 1.8.0, fixed in 1.8.6.
Fixed in v2.0.0 (released Apr 7, 2021, 35 days after disclosure, the advisory names 1.7.13, which was never published).
The latest release, v2.14.21, is not affected.