Argoproj vulnerabilities
74 CVEs and advisories name Argoproj as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113709Argo CD: A Kustomize Helm config home can run commands in the repo-server
- CVE-2026-113708Argo CD: A Kustomize remote ref can run commands in the repo-server
- CVE-2026-113672Argo CD: A Jsonnet import can read files from the repo-server
- CVE-2026-77459Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- CVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
- CVE-2026-93991Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
- CVE-2026-82277Argo Rollouts Dashboard Unauthenticated Mutating Operations
- CVE-2026-54526Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
- CVE-2026-45737Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
- CVE-2026-45738Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
- CVE-2026-15416Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
- CVE-2026-62185Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
- CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure
- CVE-2026-42295Argo Workflows: Exposure of artifact repository credentials
- CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
- CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
- CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
- CVE-2026-42880ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
- CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
- CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
- CVE-2026-31892WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-28229Argo Workflows has unauthorized access to Argo Workflows Template
- CVE-2026-23960Argo Workflows affected by stored XSS in the artifact directory listing
- CVE-2025-66626argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
- CVE-2025-62157Argo Workflows exposes artifact repository credentials in workflow-controller logs
- CVE-2025-62156argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
- CVE-2025-59538Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
- CVE-2025-59537argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
- CVE-2025-59531Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
- CVE-2025-55191Repository Credentials Race Condition Crashes Argo CD Server