GoPackage

github.com/argoproj/argo-cd/v3

12 known vulnerabilities (4 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v3.6.1 (Nov 4, 2026): no advisory affects it
Newest unaffected release: v3.6.1 (Nov 4, 2026), the latest release
Advisories: 12 · 4 critical, 6 high, 2 medium

Releases: 130 since v3.0.0 (Mar 17, 2025)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-77459
Affects v3.0.0 to v3.3.14 (v3.3.15 is outside it); v3.4.0 to v3.4.9 (v3.4.10 is outside it); v3.5.0 to v3.5.3 (v3.5.4 is outside it); v3.6.0-rc1 (v3.6.0-rc2 is outside it)
CVE-2026-55797
Affects v3.0.0 to v3.3.14 (v3.3.15 is outside it); v3.4.0 to v3.4.9 (v3.4.10 is outside it); v3.5.0 to v3.5.3 (v3.5.4 is outside it); v3.6.0-rc1 (v3.6.0-rc2 is outside it)
CVE-2026-45737
Affects v3.2.0 to v3.2.11 (v3.2.12 is outside it); v3.3.0-rc1 to v3.3.9 (v3.3.10 is outside it); v3.4.0-rc1 to v3.4.1 (v3.4.2 is outside it)
CVE-2026-45738
Affects v3.0.0-rc1 to v3.2.11 (v3.2.12 is outside it); v3.3.0-rc1 to v3.3.9 (v3.3.10 is outside it); v3.4.0-rc1 to v3.4.1 (v3.4.2 is outside it)
CVE-2026-42880
Affects v3.2.0 to v3.2.10 (v3.2.11 is outside it); v3.3.0 to v3.3.8 (v3.3.9 is outside it)
CVE-2026-43824
Affects v3.2.0 to v3.2.10 (v3.2.11 is outside it); v3.3.0 to v3.3.8 (v3.3.9 is outside it)
CVE-2025-59538
Affects v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it)
CVE-2025-59537
Affects v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it)
CVE-2025-59531
Affects v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it)
CVE-2025-55191
Affects v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it)
CVE-2025-55190
Affects v3.0.0-rc1 to v3.0.13 (v3.0.14 is outside it); v3.1.0-rc1 to v3.1.1 (v3.1.2 is outside it)
CVE-2025-47933
Affects v3.0.0-rc1 to v3.0.3 (v3.0.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

CVE-2026-77459Critical 9.9
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Affected: from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2; from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2.
Fixed in v3.3.15 (released Oct 6, 2026, 7 days before disclosure), v3.4.10 (released Oct 6, 2026, 7 days before disclosure), v3.5.4 (released Oct 6, 2026, 7 days before disclosure) and 1 other version.
The latest release, v3.6.1, is not affected.
CVE-2026-55797High 8.8
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Affected: from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2; from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2.
Fixed in v3.3.15 (released Oct 6, 2026, 3 days before disclosure), v3.4.10 (released Oct 6, 2026, 3 days before disclosure), v3.5.4 (released Oct 6, 2026, 3 days before disclosure) and 1 other version.
The latest release, v3.6.1, is not affected.
CVE-2026-45737Medium 6.3
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Affected: from 3.2.0, fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2; from 3.2.0, fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2.
Fixed in v3.2.12 (released May 12, 2026, 64 days before disclosure), v3.3.10 (released May 12, 2026, 64 days before disclosure) and v3.4.2 (released May 12, 2026, 64 days before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2026-45738High 7.3
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Affected: fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2; fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2.
Fixed in v3.2.12 (released May 12, 2026, 64 days before disclosure), v3.3.10 (released May 12, 2026, 64 days before disclosure) and v3.4.2 (released May 12, 2026, 64 days before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2026-42880Critical 9.6
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Affected: from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9; from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9.
Fixed in v3.2.11 (released Apr 30, 2026, 7 days before disclosure) and v3.3.9 (released Apr 30, 2026, 7 days before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2026-43824High 7.7
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
Affected: from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9; from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9.
Fixed in v3.2.11 (released Apr 30, 2026, 2 days before disclosure) and v3.3.9 (released Apr 30, 2026, 2 days before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-59538High 7.5
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2.
Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-59537High 7.5
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2.
Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-59531High 7.5
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Affected: from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19.
Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-55191Medium 6.5
Repository Credentials Race Condition Crashes Argo CD Server
Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2.
Fixed in v3.0.19 (released Sep 30, 2025, the day of disclosure), v3.1.8 (released Sep 30, 2025, the day of disclosure) and v3.2.0-rc2 (released Sep 30, 2025, the day of disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-55190Critical 10.0
Argo CD: Project API Token Exposes Repository Credentials
Affected: fixed in 3.0.14; from 3.1.0-rc1, fixed in 3.1.2; fixed in 3.0.14; from 3.1.0-rc1, fixed in 3.1.2.
Fixed in v3.0.14 (released Sep 4, 2025, the day of disclosure) and v3.1.2 (released Sep 4, 2025, the day of disclosure).
The latest release, v3.6.1, is not affected.
CVE-2025-47933Critical 9.1
Argo CD allows cross-site scripting on repositories page
Affected: fixed in 3.0.4.
Fixed in v3.0.4 (released May 28, 2025, 1 day before disclosure).
The latest release, v3.6.1, is not affected.