# github.com/argoproj/argo-cd/v2 (Go) vulnerabilities

51 known vulnerabilities (13 critical, 14 high, 20 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v2.14.21 (Nov 4, 2025): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 337 since v2.0.0 (Apr 7, 2021)
- Registry: https://pkg.go.dev/github.com/argoproj/argo-cd/v2
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-77459: v2.10.0 to v2.14.21 (through the newest release)
- CVE-2026-55797: v2.11.0 to v2.14.21 (through the newest release)
- CVE-2026-45737: v2.0.0-rc3 to v2.14.21 (through the newest release)
- CVE-2026-45738: v2.0.0-rc3 to v2.14.21 (through the newest release)
- CVE-2026-42880: v2.0.0-rc3 to v2.14.21 (through the newest release)
- CVE-2026-43824: v2.0.0-rc3 to v2.14.21 (through the newest release)
- CVE-2025-59538: v2.9.0-rc1 to v2.14.19 (v2.14.20 is outside it)
- CVE-2025-59537: v2.0.0-rc3 to v2.14.19 (v2.14.20 is outside it)
- CVE-2025-59531: v2.0.0-rc3 to v2.14.19 (v2.14.20 is outside it)
- CVE-2025-55191: v2.1.0 to v2.14.19 (v2.14.20 is outside it)
- CVE-2025-55190: v2.13.0 to v2.13.8 (v2.13.9 is outside it); v2.14.0 to v2.14.15 (v2.14.16 is outside it)
- CVE-2025-47933: v2.0.0-rc3 to v2.13.7 (v2.13.8 is outside it); v2.14.0-rc1 to v2.14.12 (v2.14.13 is outside it)
- CVE-2025-23216: v2.0.0-rc3 to v2.11.12 (v2.11.13 is outside it); v2.12.0 to v2.12.9 (v2.12.10 is outside it); v2.13.0 to v2.13.3 (v2.13.4 is outside it)
- CVE-2024-41666: v2.6.0 to v2.9.20 (v2.9.21 is outside it); v2.10.0 to v2.10.15 (v2.10.16 is outside it); v2.11.0 to v2.11.6 (v2.11.7 is outside it)
- CVE-2024-40634: v2.0.0-rc3 to v2.9.19 (v2.9.20 is outside it); v2.10.0 to v2.10.14 (v2.10.15 is outside it); v2.11.0 to v2.11.5 (v2.11.6 is outside it)
- CVE-2024-37152: v2.9.3 to v2.9.16 (v2.9.17 is outside it); v2.10.0 to v2.10.11 (v2.10.12 is outside it); v2.11.0 to v2.11.2 (v2.11.3 is outside it)
- CVE-2024-36106: v2.0.0-rc3 to v2.9.16 (v2.9.17 is outside it); v2.10.0 to v2.10.11 (v2.10.12 is outside it); v2.11.0 to v2.11.2 (v2.11.3 is outside it)
- CVE-2024-31989: v2.0.0-rc3 to v2.8.18 (v2.8.19 is outside it); v2.9.0-rc1 to v2.9.14 (v2.9.15 is outside it); v2.10.0-rc1 to v2.10.9 (v2.10.10 is outside it); v2.11.0-rc1 to v2.11.0 (v2.11.1 is outside it)
- CVE-2024-32476: v2.0.0-rc3 to v2.8.16 (v2.8.17 is outside it); v2.9.0 to v2.9.12 (v2.9.13 is outside it); v2.10.0 to v2.10.7 (v2.10.8 is outside it)
- CVE-2024-31990: v2.4.0 to v2.8.15 (v2.8.16 is outside it); v2.9.0 to v2.9.11 (v2.9.12 is outside it); v2.10.0 to v2.10.6 (v2.10.7 is outside it)
- CVE-2024-29893: v2.4.0 to v2.8.13 (v2.8.14 is outside it); v2.9.0 to v2.9.9 (v2.9.10 is outside it); v2.10.0 to v2.10.4 (v2.10.5 is outside it)
- CVE-2024-21662: v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
- CVE-2024-21661: v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
- CVE-2024-21652: v2.0.0-rc3 to v2.8.12 (v2.8.13 is outside it); v2.9.0 to v2.9.8 (v2.9.9 is outside it); v2.10.0 to v2.10.3 (v2.10.4 is outside it)
- CVE-2023-50726: v2.0.0-rc3 to v2.8.11 (v2.8.12 is outside it); v2.9.0 to v2.9.7 (v2.9.8 is outside it); v2.10.0 to v2.10.2 (v2.10.3 is outside it)
- CVE-2024-28175: v2.0.0 to v2.8.11 (v2.8.12 is outside it); v2.9.0 to v2.9.7 (v2.9.8 is outside it); v2.10.0 to v2.10.2 (v2.10.3 is outside it)
- CVE-2024-22424: v2.0.0-rc3 to v2.7.15 (v2.7.16 is outside it); v2.8.0-rc1 to v2.8.7 (v2.8.8 is outside it); v2.9.0-rc1 to v2.9.3 (v2.9.4 is outside it); v2.10.0-rc1 (v2.10.0-rc2 is outside it)
- CVE-2023-40026: v2.0.0-rc3 to v2.3.0-rc5 (v2.3.0 is outside it)
- CVE-2023-40584: v2.4.0 to v2.6.14 (v2.6.15 is outside it); v2.7.0 to v2.7.13 (v2.7.14 is outside it); v2.8.0 to v2.8.2 (v2.8.3 is outside it)
- CVE-2023-40029: v2.2.0 to v2.6.14 (v2.6.15 is outside it); v2.7.0 to v2.7.13 (v2.7.14 is outside it); v2.8.0 to v2.8.2 (v2.8.3 is outside it)
- CVE-2023-40025: v2.6.0 to v2.6.13 (v2.6.14 is outside it); v2.7.0 to v2.7.11 (v2.7.12 is outside it); v2.8.0 (v2.8.1 is outside it)
- CVE-2022-41354: v2.0.0-rc3 to v2.4.27 (v2.4.28 is outside it); v2.5.0 to v2.5.15 (v2.5.16 is outside it); v2.6.0 to v2.6.6 (v2.6.7 is outside it)
- CVE-2023-23947: v2.3.0 to v2.3.16 (v2.3.17 is outside it); v2.4.0 to v2.4.22 (v2.4.23 is outside it); v2.5.0 to v2.5.10 (v2.5.11 is outside it); v2.6.0 to v2.6.1 (v2.6.2 is outside it)
- CVE-2023-25163: v2.6.0-rc1 to v2.6.0 (v2.6.1 is outside it)
- CVE-2023-22736: v2.5.0-rc1 to v2.5.7 (v2.5.8 is outside it); v2.6.0-rc4 (v2.6.0-rc5 is outside it)
- CVE-2023-22482: v2.0.0-rc3 to v2.3.13 (v2.3.14 is outside it); v2.4.0 to v2.4.19 (v2.4.20 is outside it); v2.5.0 to v2.5.7 (v2.5.8 is outside it); v2.6.0-rc1 to v2.6.0-rc4 (v2.6.0-rc5 is outside it)
- CVE-2022-31102: v2.3.0 to v2.3.5 (v2.3.6 is outside it); v2.4.0 to v2.4.4 (v2.4.5 is outside it)
- CVE-2022-31105: v2.0.0-rc3 to v2.2.10 (v2.2.11 is outside it); v2.3.0 to v2.3.5 (v2.3.6 is outside it); v2.4.0 to v2.4.4 (v2.4.5 is outside it)
- CVE-2022-1025: v2.0.0-rc3 to v2.1.13 (v2.1.14 is outside it); v2.2.0 to v2.2.8-1 (v2.2.8 is outside it); v2.3.0 to v2.3.1 (v2.3.2 is outside it)
- CVE-2022-31036: v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
- CVE-2022-31035: v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
- CVE-2022-31034: v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
- CVE-2022-31016: v2.0.0-rc3 to v2.1.15 (v2.1.16 is outside it); v2.2.0 to v2.2.9 (v2.2.10 is outside it); v2.3.0 to v2.3.4 (v2.3.5 is outside it); v2.4.0 (v2.4.1 is outside it)
- CVE-2022-29165: v2.0.0-rc3 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
- CVE-2022-24905: v2.0.0 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
- CVE-2022-24904: v2.0.0-rc3 to v2.1.14 (v2.1.15 is outside it); v2.2.0 to v2.2.8 (v2.2.9 is outside it); v2.3.0 to v2.3.3 (v2.3.4 is outside it)
- CVE-2022-24768: v2.0.0-rc3 to v2.1.13 (v2.1.14 is outside it); v2.2.0 to v2.2.8-1 (v2.2.8 is outside it); v2.3.0 to v2.3.1 (v2.3.2 is outside it)
- CVE-2022-24731: v2.0.0-rc3 to v2.1.10 (v2.1.11 is outside it); v2.2.0 to v2.2.5 (v2.2.6 is outside it); v2.3.0-rc1 to v2.3.0-rc5 (v2.3.0 is outside it)
- CVE-2022-24730: v2.0.0-rc3 to v2.1.10 (v2.1.11 is outside it); v2.2.0 to v2.2.5 (v2.2.6 is outside it); v2.3.0-rc1 to v2.3.0-rc5 (v2.3.0 is outside it)
- CVE-2022-24348: v2.0.0-rc3 to v2.1.8 (v2.1.9 is outside it); v2.2.0 to v2.2.3 (v2.2.4 is outside it)
- CVE-2021-23347: no published release is affected

## Advisories (51)

### [CVE-2026-77459](https://cve.now/CVE-2026-77459): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

- Severity: Critical 9.9
- Published: Oct 13, 2026
- Affected: from 2.10.0, through 2.14.21; from 2.10.0.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2026-55797](https://cve.now/CVE-2026-55797): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

- Severity: High 8.8
- Published: Oct 9, 2026
- Affected: from 2.11.0, through 2.14.21; from 2.11.0.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2026-45737](https://cve.now/CVE-2026-45737): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

- Severity: Medium 6.3
- Published: Jul 15, 2026
- Affected: all versions.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2026-45738](https://cve.now/CVE-2026-45738): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

- Severity: High 7.3
- Published: Jul 15, 2026
- Affected: through 2.14.21; all versions.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2026-42880](https://cve.now/CVE-2026-42880): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

- Severity: Critical 9.6
- Published: May 7, 2026
- Affected: all versions.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2026-43824](https://cve.now/CVE-2026-43824): In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

- Severity: High 7.7
- Published: May 2, 2026
- Affected: all versions.
- No fix released. The latest release, v2.14.21, is still affected.

### [CVE-2025-59538](https://cve.now/CVE-2025-59538): Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: from 2.9.0-rc1, fixed in 2.14.20.
- Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-59537](https://cve.now/CVE-2025-59537): argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: from 2.0.0-rc1, fixed in 2.14.20; fixed in 2.14.20.
- Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-59531](https://cve.now/CVE-2025-59531): Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

- Severity: High 7.5
- Published: Oct 1, 2025
- Affected: fixed in 2.14.20; from 2.0.0-rc1, fixed in 2.14.20.
- Fixed in v2.14.20 (released Sep 30, 2025, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-55191](https://cve.now/CVE-2025-55191): Repository Credentials Race Condition Crashes Argo CD Server

- Severity: Medium 6.5
- Published: Sep 30, 2025
- Affected: from 2.1.0, fixed in 2.14.20.
- Fixed in v2.14.20 (released Sep 30, 2025, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-55190](https://cve.now/CVE-2025-55190): Argo CD: Project API Token Exposes Repository Credentials

- Severity: Critical 10.0
- Published: Sep 4, 2025
- Affected: from 2.13.0, fixed in 2.13.9; from 2.14.0, fixed in 2.14.16; from 2.13.0, fixed in 2.13.9; from 2.14.0, fixed in 2.14.16.
- Fixed in v2.13.9 (released Sep 4, 2025, the day of disclosure) and v2.14.16 (released Sep 4, 2025, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-47933](https://cve.now/CVE-2025-47933): Argo CD allows cross-site scripting on repositories page

- Severity: Critical 9.1
- Published: May 29, 2025
- Affected: from 2.0.0-rc3, fixed in 2.13.8; from 2.14.0-rc1, fixed in 2.14.13; from 2.0.0-rc3, fixed in 2.13.8; from 2.14.0-rc1, fixed in 2.14.13.
- Fixed in v2.13.8 (released May 28, 2025, 1 day before disclosure) and v2.14.13 (released May 28, 2025, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2025-23216](https://cve.now/CVE-2025-23216): Argo CD does not scrub secret values from patch errors

- Severity: Medium 6.8
- Published: Jan 30, 2025
- Affected: from 2.13.0, fixed in 2.13.4; from 2.12.0, fixed in 2.12.10; fixed in 2.11.13; fixed in 2.11.13; from 2.12.0, fixed in 2.12.10; from 2.13.0, fixed in 2.13.4.
- Fixed in v2.11.13 (released Jan 29, 2025, 1 day before disclosure), v2.12.10 (released Jan 29, 2025, 1 day before disclosure) and v2.13.4 (released Jan 29, 2025, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-41666](https://cve.now/CVE-2024-41666): The Argo CD web terminal session does not handle the revocation of user permissions properly.

- Severity: Medium 4.7
- Published: Jul 24, 2024
- Affected: from 2.6.0, fixed in 2.9.21; from 2.10.0, fixed in 2.10.16; from 2.11.0, fixed in 2.11.7; from 2.6.0, fixed in 2.9.21; from 2.10.0, fixed in 2.10.16; from 2.11.0, fixed in 2.11.7.
- Fixed in v2.9.21 (released Jul 24, 2024, the day of disclosure), v2.10.16 (released Jul 24, 2024, the day of disclosure) and v2.11.7 (released Jul 24, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-40634](https://cve.now/CVE-2024-40634): Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

- Severity: High 7.5
- Published: Jul 22, 2024
- Affected: fixed in 2.9.20; from 2.10.0, fixed in 2.10.15; from 2.11.0, fixed in 2.11.6; fixed in 2.9.20; from 2.10.0, fixed in 2.10.15; from 2.11.0, fixed in 2.11.6.
- Fixed in v2.9.20 (released Jul 22, 2024, the day of disclosure), v2.10.15 (released Jul 22, 2024, the day of disclosure) and v2.11.6 (released Jul 22, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-37152](https://cve.now/CVE-2024-37152): Unauthenticated Access to sensitive settings in Argo CD

- Severity: Medium 5.3
- Published: Jun 6, 2024
- Affected: from 2.9.3, fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3.
- Fixed in v2.9.17 (released Jun 6, 2024, the day of disclosure), v2.10.12 (released Jun 6, 2024, the day of disclosure) and v2.11.3 (released Jun 6, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-36106](https://cve.now/CVE-2024-36106): Argo CD allows authenticated users to enumerate clusters by name

- Severity: Medium 4.3
- Published: Jun 6, 2024
- Affected: fixed in 2.9.17; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.3.
- Fixed in v2.9.17 (released Jun 6, 2024, the day of disclosure), v2.10.12 (released Jun 6, 2024, the day of disclosure) and v2.11.3 (released Jun 6, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-31989](https://cve.now/CVE-2024-31989): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

- Severity: Critical 9.1
- Published: May 21, 2024
- Affected: fixed in 2.8.19; from 2.9.0-rc1, fixed in 2.9.15; from 2.10.0-rc1, fixed in 2.10.10; from 2.11.0-rc1, fixed in 2.11.1; fixed in 2.8.19; from 2.9.0-rc1, fixed in 2.9.15; from 2.10.0-rc1, fixed in 2.10.10; from 2.11.0-rc1, fixed in 2.11.1.
- Fixed in v2.8.19 (released May 21, 2024, the day of disclosure), v2.9.15 (released May 21, 2024, the day of disclosure), v2.10.10 (released May 21, 2024, the day of disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2024-32476](https://cve.now/CVE-2024-32476): Denial of Service via malicious jqPathExpressions in ignoreDifferences

- Severity: Medium 6.5
- Published: Apr 26, 2024
- Affected: fixed in 2.8.17; from 2.9.0, fixed in 2.9.13; from 2.10.0, fixed in 2.10.8; from 2.10.0, fixed in 2.10.8; from 2.9.0, fixed in 2.9.13; fixed in 2.8.17.
- Fixed in v2.8.17 (released Apr 26, 2024, the day of disclosure), v2.9.13 (released Apr 26, 2024, the day of disclosure) and v2.10.8 (released Apr 26, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-31990](https://cve.now/CVE-2024-31990): Argo CD' API server does not enforce project sourceNamespaces

- Severity: Medium 4.8
- Published: Apr 15, 2024
- Affected: from 2.4.0, fixed in 2.8.16; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.7; from 2.4.0, fixed in 2.8.16; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.7.
- Fixed in v2.8.16 (released Apr 15, 2024, the day of disclosure), v2.9.12 (released Apr 15, 2024, the day of disclosure) and v2.10.7 (released Apr 15, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-29893](https://cve.now/CVE-2024-29893): Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

- Severity: Medium 6.5
- Published: Mar 29, 2024
- Affected: from 2.4.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.5; from 2.4.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.5.
- Fixed in v2.8.14 (released Mar 28, 2024, 1 day before disclosure), v2.9.10 (released Mar 28, 2024, 1 day before disclosure) and v2.10.5 (released Mar 28, 2024, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-21662](https://cve.now/CVE-2024-21662): Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

- Severity: High 7.5
- Published: Mar 18, 2024
- Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
- Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-21661](https://cve.now/CVE-2024-21661): Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

- Severity: High 7.5
- Published: Mar 18, 2024
- Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
- Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-21652](https://cve.now/CVE-2024-21652): Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

- Severity: Critical 9.8
- Published: Mar 18, 2024
- Affected: fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4; fixed in 2.8.13; from 2.9.0, fixed in 2.9.9; from 2.10.0, fixed in 2.10.4.
- Fixed in v2.8.13 (released Mar 18, 2024, the day of disclosure), v2.9.9 (released Mar 18, 2024, the day of disclosure) and v2.10.4 (released Mar 18, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-50726](https://cve.now/CVE-2023-50726): Users with \`create\` but not \`override\` privileges can perform local sync in argo-cd

- Severity: Medium 6.4
- Published: Mar 13, 2024
- Affected: from 2.0.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.0.0-rc3, fixed in 2.8.12.
- Fixed in v2.8.12 (released Mar 13, 2024, the day of disclosure), v2.9.8 (released Mar 13, 2024, the day of disclosure) and v2.10.3 (released Mar 13, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-28175](https://cve.now/CVE-2024-28175): Cross-site scripting on application summary component in argo-cd

- Severity: Critical 9.1
- Published: Mar 13, 2024
- Affected: from 2.0.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.9.0, fixed in 2.9.8; from 2.10.0, fixed in 2.10.3; from 2.0.0, fixed in 2.8.12.
- Fixed in v2.8.12 (released Mar 13, 2024, the day of disclosure), v2.9.8 (released Mar 13, 2024, the day of disclosure) and v2.10.3 (released Mar 13, 2024, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2024-22424](https://cve.now/CVE-2024-22424): Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

- Severity: High 8.4
- Published: Jan 19, 2024
- Affected: fixed in 2.7.16; from 2.8.0-rc1, fixed in 2.8.8; from 2.9.0-rc1, fixed in 2.9.4; from 2.10.0-rc1, fixed in 2.10-rc2.
- Fixed in v2.7.16 (released Jan 19, 2024, the day of disclosure), v2.8.8 (released Jan 19, 2024, the day of disclosure), v2.9.4 (released Jan 18, 2024, 1 day before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2023-40026](https://cve.now/CVE-2023-40026): Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

- Severity: Medium 5.0
- Published: Sep 27, 2023
- Affected: fixed in 2.3.0.
- Fixed in v2.3.0 (released Mar 6, 2022, 570 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-40584](https://cve.now/CVE-2023-40584): Denial of Service to Argo CD repo-server

- Severity: Medium 6.5
- Published: Sep 7, 2023
- Affected: from 2.4.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3; from 2.4.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3.
- Fixed in v2.6.15 (released Sep 7, 2023, the day of disclosure), v2.7.14 (released Sep 7, 2023, the day of disclosure) and v2.8.3 (released Sep 7, 2023, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-40029](https://cve.now/CVE-2023-40029): Cluster secret might leak in cluster details page in Argo CD

- Severity: Critical 9.9
- Published: Sep 7, 2023
- Affected: from 2.2.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3; from 2.2.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.3.
- Fixed in v2.6.15 (released Sep 7, 2023, the day of disclosure), v2.7.14 (released Sep 7, 2023, the day of disclosure) and v2.8.3 (released Sep 7, 2023, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-40025](https://cve.now/CVE-2023-40025): Argo CD web terminal session doesn't expire

- Severity: Medium 4.7
- Published: Aug 23, 2023
- Affected: from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.1; from 2.0.0-20230718200744-12a5a7a70d6e, fixed in 2.0.0-20230821201509-e047efa8f951; from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.1.
- Fixed in v2.0.0 (released Apr 7, 2021, 868 days before disclosure, the advisory names 2.0.0-20230821201509-e047efa8f951, which was never published), v2.6.14 (released Aug 7, 2023, 16 days before disclosure), v2.7.12 (released Aug 21, 2023, 2 days before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-41354](https://cve.now/CVE-2022-41354): An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

- Severity: Unrated
- Published: Mar 27, 2023
- Affected: fixed in 2.4.28; from 2.5.0, fixed in 2.5.16; from 2.6.0, fixed in 2.6.7; from 2.5.0, fixed in 2.5.16; from 2.6.0, fixed in 2.6.7; fixed in 2.4.28.
- Fixed in v2.4.28 (released Mar 23, 2023, 4 days before disclosure), v2.5.16 (released Mar 23, 2023, 4 days before disclosure) and v2.6.7 (released Mar 23, 2023, 4 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-23947](https://cve.now/CVE-2023-23947): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

- Severity: Critical 9.1
- Published: Feb 16, 2023
- Affected: from 2.3.0, fixed in 2.3.17; from 2.4.0, fixed in 2.4.23; from 2.5.0, fixed in 2.5.11; from 2.6.0, fixed in 2.6.2.
- Fixed in v2.3.17 (released Feb 16, 2023, the day of disclosure), v2.4.23 (released Feb 16, 2023, the day of disclosure), v2.5.11 (released Feb 16, 2023, the day of disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2023-25163](https://cve.now/CVE-2023-25163): Argo CD leaks repository credentials in user-facing error messages and in logs

- Severity: Medium 6.3
- Published: Feb 8, 2023
- Affected: from 2.6.0-rc1, fixed in 2.6.1.
- Fixed in v2.6.1 (released Feb 8, 2023, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-22736](https://cve.now/CVE-2023-22736): argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

- Severity: High 8.6
- Published: Jan 26, 2023
- Affected: from 2.5.0-rc1, fixed in 2.5.8; from 2.6.0-rc4, fixed in 2.6.0-rc5; from 2.5.0-rc1, fixed in 2.5.8; from 2.6.0-rc4, fixed in 2.6.0-rc5.
- Fixed in v2.5.8 (released Jan 25, 2023, 1 day before disclosure) and v2.6.0-rc5 (released Jan 25, 2023, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2023-22482](https://cve.now/CVE-2023-22482): JWT audience claim is not verified

- Severity: Critical 9.1
- Published: Jan 25, 2023
- Affected: fixed in 2.3.14; from 2.4.0, fixed in 2.4.20; from 2.5.0, fixed in 2.5.8; from 2.6.0-rc1, fixed in 2.6.0-rc5.
- Fixed in v2.3.14 (released Jan 25, 2023, the day of disclosure), v2.4.20 (released Jan 25, 2023, the day of disclosure), v2.5.8 (released Jan 25, 2023, the day of disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31102](https://cve.now/CVE-2022-31102): Cross-site Scripting for Argo CD single sign on users

- Severity: Low 2.6
- Published: Jul 12, 2022
- Affected: from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5.
- Fixed in v2.3.6 (released Jul 12, 2022, the day of disclosure) and v2.4.5 (released Jul 12, 2022, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31105](https://cve.now/CVE-2022-31105): Argo CD's certificate verification is skipped for connections to OIDC providers

- Severity: High 8.3
- Published: Jul 12, 2022
- Affected: fixed in 2.2.11; from 2.3.0, fixed in 2.3.6; from 2.4.0, fixed in 2.4.5.
- Fixed in v2.2.11 (released Jul 12, 2022, the day of disclosure), v2.3.6 (released Jul 12, 2022, the day of disclosure) and v2.4.5 (released Jul 12, 2022, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-1025](https://cve.now/CVE-2022-1025): All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to…

- Severity: Unrated
- Published: Jul 12, 2022
- Affected: fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2.
- Fixed in v2.1.14 (released Mar 23, 2022, 111 days before disclosure), v2.2.8 (released Mar 23, 2022, 111 days before disclosure) and v2.3.2 (released Mar 23, 2022, 111 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31036](https://cve.now/CVE-2022-31036): Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

- Severity: Medium 4.3
- Published: Jun 27, 2022
- Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
- Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31035](https://cve.now/CVE-2022-31035): External URLs for Deployments can include javascript in argo-cd

- Severity: Critical 9.0
- Published: Jun 27, 2022
- Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
- Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31034](https://cve.now/CVE-2022-31034): Insecure entropy in argo-cd

- Severity: High 8.3
- Published: Jun 27, 2022
- Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
- Fixed in v2.1.16 (released Jun 21, 2022, 6 days before disclosure), v2.2.10 (released Jun 21, 2022, 6 days before disclosure), v2.3.5 (released Jun 21, 2022, 6 days before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-31016](https://cve.now/CVE-2022-31016): Argo CD vulnerable to Uncontrolled Memory Consumption

- Severity: Medium 6.5
- Published: Jun 25, 2022
- Affected: fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1; fixed in 2.1.16; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.5; from 2.4.0, fixed in 2.4.1.
- Fixed in v2.1.16 (released Jun 21, 2022, 4 days before disclosure), v2.2.10 (released Jun 21, 2022, 4 days before disclosure), v2.3.5 (released Jun 21, 2022, 4 days before disclosure) and 1 other version.
- The latest release, v2.14.21, is not affected.

### [CVE-2022-29165](https://cve.now/CVE-2022-29165): Argo CD will blindly trust JWT claims if anonymous access is enabled

- Severity: Critical 10.0
- Published: May 20, 2022
- Affected: from 2.3.0, fixed in 2.3.4; from 2.2.0, fixed in 2.2.9; fixed in 2.1.15; fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4.
- Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24905](https://cve.now/CVE-2022-24905): Argo CD login screen allows message spoofing if SSO is enabled

- Severity: Medium 4.3
- Published: May 20, 2022
- Affected: from 2.0.0, fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4; from 2.3.0, fixed in 2.3.4; from 2.2.0, fixed in 2.2.9; from 2.0.0, fixed in 2.1.15.
- Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24904](https://cve.now/CVE-2022-24904): Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

- Severity: Medium 4.3
- Published: May 20, 2022
- Affected: fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4; fixed in 2.1.15; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.4.
- Fixed in v2.1.15 (released May 18, 2022, 2 days before disclosure), v2.2.9 (released May 18, 2022, 2 days before disclosure) and v2.3.4 (released May 18, 2022, 2 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24768](https://cve.now/CVE-2022-24768): Improper access control allows admin privilege escalation in Argo CD

- Severity: Critical 9.9
- Published: Mar 23, 2022
- Affected: fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2; fixed in 2.1.14; from 2.2.0, fixed in 2.2.8; from 2.3.0, fixed in 2.3.2.
- Fixed in v2.1.14 (released Mar 23, 2022, the day of disclosure), v2.2.8 (released Mar 23, 2022, the day of disclosure) and v2.3.2 (released Mar 23, 2022, the day of disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24731](https://cve.now/CVE-2022-24731): Path traversal allows leaking out-of-bound files from Argo CD repo-server

- Severity: Medium 6.8
- Published: Mar 23, 2022
- Affected: fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
- Fixed in v2.1.11 (released Mar 6, 2022, 17 days before disclosure), v2.2.6 (released Mar 6, 2022, 17 days before disclosure) and v2.3.0 (released Mar 6, 2022, 17 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24730](https://cve.now/CVE-2022-24730): Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

- Severity: High 7.7
- Published: Mar 23, 2022
- Affected: fixed in 2.1.11; from 2.2.0, fixed in 2.2.6; from 2.3.0-rc1, fixed in 2.3.0.
- Fixed in v2.1.11 (released Mar 6, 2022, 17 days before disclosure), v2.2.6 (released Mar 6, 2022, 17 days before disclosure) and v2.3.0 (released Mar 6, 2022, 17 days before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2022-24348](https://cve.now/CVE-2022-24348): Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in…

- Severity: Unrated
- Published: Feb 4, 2022
- Affected: fixed in 2.1.9; from 2.2.0, fixed in 2.2.4; fixed in 2.1.9; from 2.2.0, fixed in 2.2.4.
- Fixed in v2.1.9 (released Feb 3, 2022, 1 day before disclosure) and v2.2.4 (released Feb 3, 2022, 1 day before disclosure).
- The latest release, v2.14.21, is not affected.

### [CVE-2021-23347](https://cve.now/CVE-2021-23347): Cross-site Scripting (XSS)

- Severity: Medium 4.7
- Published: Mar 3, 2021
- Affected: fixed in 1.7.13; from 1.8.0, fixed in 1.8.6.
- Fixed in v2.0.0 (released Apr 7, 2021, 35 days after disclosure, the advisory names 1.7.13, which was never published).
- The latest release, v2.14.21, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/argoproj/argo-cd/v2
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.