# github.com/argoproj/argo-cd/v3 (Go) vulnerabilities 12 known vulnerabilities (4 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v3.6.1 (Nov 4, 2026): no advisory affects it - Newest unaffected release: v3.6.1 (Nov 4, 2026), the latest release - Releases: 130 since v3.0.0 (Mar 17, 2025) - Registry: https://pkg.go.dev/github.com/argoproj/argo-cd/v3 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-77459: v3.0.0 to v3.3.14 (v3.3.15 is outside it); v3.4.0 to v3.4.9 (v3.4.10 is outside it); v3.5.0 to v3.5.3 (v3.5.4 is outside it); v3.6.0-rc1 (v3.6.0-rc2 is outside it) - CVE-2026-55797: v3.0.0 to v3.3.14 (v3.3.15 is outside it); v3.4.0 to v3.4.9 (v3.4.10 is outside it); v3.5.0 to v3.5.3 (v3.5.4 is outside it); v3.6.0-rc1 (v3.6.0-rc2 is outside it) - CVE-2026-45737: v3.2.0 to v3.2.11 (v3.2.12 is outside it); v3.3.0-rc1 to v3.3.9 (v3.3.10 is outside it); v3.4.0-rc1 to v3.4.1 (v3.4.2 is outside it) - CVE-2026-45738: v3.0.0-rc1 to v3.2.11 (v3.2.12 is outside it); v3.3.0-rc1 to v3.3.9 (v3.3.10 is outside it); v3.4.0-rc1 to v3.4.1 (v3.4.2 is outside it) - CVE-2026-42880: v3.2.0 to v3.2.10 (v3.2.11 is outside it); v3.3.0 to v3.3.8 (v3.3.9 is outside it) - CVE-2026-43824: v3.2.0 to v3.2.10 (v3.2.11 is outside it); v3.3.0 to v3.3.8 (v3.3.9 is outside it) - CVE-2025-59538: v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it) - CVE-2025-59537: v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it) - CVE-2025-59531: v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it) - CVE-2025-55191: v3.0.0-rc1 to v3.0.18 (v3.0.19 is outside it); v3.1.0-rc1 to v3.1.7 (v3.1.8 is outside it); v3.2.0-rc1 (v3.2.0-rc2 is outside it) - CVE-2025-55190: v3.0.0-rc1 to v3.0.13 (v3.0.14 is outside it); v3.1.0-rc1 to v3.1.1 (v3.1.2 is outside it) - CVE-2025-47933: v3.0.0-rc1 to v3.0.3 (v3.0.4 is outside it) ## Advisories (12) ### [CVE-2026-77459](https://cve.now/CVE-2026-77459): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks - Severity: Critical 9.9 - Published: Oct 13, 2026 - Affected: from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2; from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2. - Fixed in v3.3.15 (released Oct 6, 2026, 7 days before disclosure), v3.4.10 (released Oct 6, 2026, 7 days before disclosure), v3.5.4 (released Oct 6, 2026, 7 days before disclosure) and 1 other version. - The latest release, v3.6.1, is not affected. ### [CVE-2026-55797](https://cve.now/CVE-2026-55797): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL - Severity: High 8.8 - Published: Oct 9, 2026 - Affected: from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2; from 3.0.0, fixed in 3.3.15; from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.4; from 3.6.0-rc1, fixed in 3.6.0-rc2. - Fixed in v3.3.15 (released Oct 6, 2026, 3 days before disclosure), v3.4.10 (released Oct 6, 2026, 3 days before disclosure), v3.5.4 (released Oct 6, 2026, 3 days before disclosure) and 1 other version. - The latest release, v3.6.1, is not affected. ### [CVE-2026-45737](https://cve.now/CVE-2026-45737): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations - Severity: Medium 6.3 - Published: Jul 15, 2026 - Affected: from 3.2.0, fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2; from 3.2.0, fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2. - Fixed in v3.2.12 (released May 12, 2026, 64 days before disclosure), v3.3.10 (released May 12, 2026, 64 days before disclosure) and v3.4.2 (released May 12, 2026, 64 days before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2026-45738](https://cve.now/CVE-2026-45738): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation - Severity: High 7.3 - Published: Jul 15, 2026 - Affected: fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2; fixed in 3.2.12; from 3.3.0-rc1, fixed in 3.3.10; from 3.4.0-rc1, fixed in 3.4.2. - Fixed in v3.2.12 (released May 12, 2026, 64 days before disclosure), v3.3.10 (released May 12, 2026, 64 days before disclosure) and v3.4.2 (released May 12, 2026, 64 days before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2026-42880](https://cve.now/CVE-2026-42880): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction - Severity: Critical 9.6 - Published: May 7, 2026 - Affected: from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9; from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9. - Fixed in v3.2.11 (released Apr 30, 2026, 7 days before disclosure) and v3.3.9 (released Apr 30, 2026, 7 days before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2026-43824](https://cve.now/CVE-2026-43824): In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. - Severity: High 7.7 - Published: May 2, 2026 - Affected: from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9; from 3.2.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.9. - Fixed in v3.2.11 (released Apr 30, 2026, 2 days before disclosure) and v3.3.9 (released Apr 30, 2026, 2 days before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-59538](https://cve.now/CVE-2025-59538): Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook - Severity: High 7.5 - Published: Oct 1, 2025 - Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2. - Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-59537](https://cve.now/CVE-2025-59537): argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload - Severity: High 7.5 - Published: Oct 1, 2025 - Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2. - Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-59531](https://cve.now/CVE-2025-59531): Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload - Severity: High 7.5 - Published: Oct 1, 2025 - Affected: from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19. - Fixed in v3.0.19 (released Sep 30, 2025, 1 day before disclosure), v3.1.8 (released Sep 30, 2025, 1 day before disclosure) and v3.2.0-rc2 (released Sep 30, 2025, 1 day before disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-55191](https://cve.now/CVE-2025-55191): Repository Credentials Race Condition Crashes Argo CD Server - Severity: Medium 6.5 - Published: Sep 30, 2025 - Affected: from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19; from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2. - Fixed in v3.0.19 (released Sep 30, 2025, the day of disclosure), v3.1.8 (released Sep 30, 2025, the day of disclosure) and v3.2.0-rc2 (released Sep 30, 2025, the day of disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-55190](https://cve.now/CVE-2025-55190): Argo CD: Project API Token Exposes Repository Credentials - Severity: Critical 10.0 - Published: Sep 4, 2025 - Affected: fixed in 3.0.14; from 3.1.0-rc1, fixed in 3.1.2; fixed in 3.0.14; from 3.1.0-rc1, fixed in 3.1.2. - Fixed in v3.0.14 (released Sep 4, 2025, the day of disclosure) and v3.1.2 (released Sep 4, 2025, the day of disclosure). - The latest release, v3.6.1, is not affected. ### [CVE-2025-47933](https://cve.now/CVE-2025-47933): Argo CD allows cross-site scripting on repositories page - Severity: Critical 9.1 - Published: May 29, 2025 - Affected: fixed in 3.0.4. - Fixed in v3.0.4 (released May 28, 2025, 1 day before disclosure). - The latest release, v3.6.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/argoproj/argo-cd/v3 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.