# cve.now: Argoproj

The newest entries naming Argoproj as an affected vendor (up to 200), of 74 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113709](https://cve.now/CVE-2026-113709.md): Argo CD: A Kustomize Helm config home can run commands in the repo-server (CVSS 9.9)
- [CVE-2026-113708](https://cve.now/CVE-2026-113708.md): Argo CD: A Kustomize remote ref can run commands in the repo-server (CVSS 9.9)
- [CVE-2026-113672](https://cve.now/CVE-2026-113672.md): Argo CD: A Jsonnet import can read files from the repo-server (CVSS 9.9)
- [CVE-2026-77459](https://cve.now/CVE-2026-77459.md): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (CVSS 9.9)
- [CVE-2026-55797](https://cve.now/CVE-2026-55797.md): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8)
- [CVE-2026-93991](https://cve.now/CVE-2026-93991.md): Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector (CVSS 8.3)
- [CVE-2026-82277](https://cve.now/CVE-2026-82277.md): Argo Rollouts Dashboard Unauthenticated Mutating Operations (CVSS 9.3)
- [CVE-2026-54526](https://cve.now/CVE-2026-54526.md): Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing (CVSS 8.9)
- [CVE-2026-45737](https://cve.now/CVE-2026-45737.md): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (CVSS 6.3)
- [CVE-2026-45738](https://cve.now/CVE-2026-45738.md): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation (CVSS 7.3)
- [CVE-2026-15416](https://cve.now/CVE-2026-15416.md): Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint (CVSS 8.9)
- [CVE-2026-62185](https://cve.now/CVE-2026-62185.md): Argo CD Helm Chart \< 10.0.0 Missing Network Policy RCE (CVSS 8.6)
- [CVE-2026-42296](https://cve.now/CVE-2026-42296.md): Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure (CVSS 8.1)
- [CVE-2026-42295](https://cve.now/CVE-2026-42295.md): Argo Workflows: Exposure of artifact repository credentials (CVSS 8.5)
- [CVE-2026-42294](https://cve.now/CVE-2026-42294.md): Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor (CVSS 8.2)
- [CVE-2026-42183](https://cve.now/CVE-2026-42183.md): Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) (CVSS 2.3)
- [CVE-2026-42297](https://cve.now/CVE-2026-42297.md): Argo Workflows Is Missing Authorization in Sync ConfigMap Provider (CVSS 8.5)
- [CVE-2026-42880](https://cve.now/CVE-2026-42880.md): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction (CVSS 9.6)
- [CVE-2026-43824](https://cve.now/CVE-2026-43824.md): In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. (CVSS 7.7)
- [CVE-2026-40886](https://cve.now/CVE-2026-40886.md): Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller (CVSS 7.7)
- [CVE-2026-31892](https://cve.now/CVE-2026-31892.md): WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode (CVSS 8.9)
- [CVE-2026-28229](https://cve.now/CVE-2026-28229.md): Argo Workflows has unauthorized access to Argo Workflows Template (CVSS 9.8)
- [CVE-2026-23960](https://cve.now/CVE-2026-23960.md): Argo Workflows affected by stored XSS in the artifact directory listing (CVSS 7.3)
- [CVE-2025-66626](https://cve.now/CVE-2025-66626.md): argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links (CVSS 8.1)
- [CVE-2025-62157](https://cve.now/CVE-2025-62157.md): Argo Workflows exposes artifact repository credentials in workflow-controller logs (CVSS 8.5)
- [CVE-2025-62156](https://cve.now/CVE-2025-62156.md): argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite (CVSS 8.1)
- [CVE-2025-59538](https://cve.now/CVE-2025-59538.md): Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook (CVSS 7.5)
- [CVE-2025-59537](https://cve.now/CVE-2025-59537.md): argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload (CVSS 7.5)
- [CVE-2025-59531](https://cve.now/CVE-2025-59531.md): Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload (CVSS 7.5)
- [CVE-2025-55191](https://cve.now/CVE-2025-55191.md): Repository Credentials Race Condition Crashes Argo CD Server (CVSS 6.5)
- [CVE-2025-55190](https://cve.now/CVE-2025-55190.md): Argo CD: Project API Token Exposes Repository Credentials (CVSS 10.0)
- [CVE-2025-47933](https://cve.now/CVE-2025-47933.md): Argo CD allows cross-site scripting on repositories page (CVSS 9.1)
- [CVE-2025-32445](https://cve.now/CVE-2025-32445.md): Users can gain privileged access to the host system and cluster with EventSource and Sensor CR (CVSS 10.0)
- [CVE-2025-23216](https://cve.now/CVE-2025-23216.md): Argo CD does not scrub secret values from patch errors (CVSS 6.8)
- [CVE-2024-53862](https://cve.now/CVE-2024-53862.md): Argo Workflows Allows Access to Archived Workflows with Fake Token in \`client\` mode (CVSS 6.3)
- [CVE-2024-52814](https://cve.now/CVE-2024-52814.md): Helm Lacks Granularity in Workflow Role (CVSS 2.8)
- [CVE-2024-52799](https://cve.now/CVE-2024-52799.md): Argo Workflows Chart: Excessive Privileges in Workflow Role (CVSS 8.3)
- [CVE-2024-47827](https://cve.now/CVE-2024-47827.md): Argo Workflows Controller: Denial of Service via malicious daemon Workflows (CVSS 5.7)
- [CVE-2024-41666](https://cve.now/CVE-2024-41666.md): The Argo CD web terminal session does not handle the revocation of user permissions properly. (CVSS 4.7)
- [CVE-2024-40634](https://cve.now/CVE-2024-40634.md): Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint (CVSS 7.5)
- [CVE-2024-37152](https://cve.now/CVE-2024-37152.md): Unauthenticated Access to sensitive settings in Argo CD (CVSS 5.3)
- [CVE-2024-36106](https://cve.now/CVE-2024-36106.md): Argo CD allows authenticated users to enumerate clusters by name (CVSS 4.3)
- [CVE-2024-31989](https://cve.now/CVE-2024-31989.md): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache (CVSS 9.1)
- [CVE-2024-32476](https://cve.now/CVE-2024-32476.md): Denial of Service via malicious jqPathExpressions in ignoreDifferences (CVSS 6.5)
- [CVE-2024-31990](https://cve.now/CVE-2024-31990.md): Argo CD' API server does not enforce project sourceNamespaces (CVSS 4.8)
- [CVE-2024-29893](https://cve.now/CVE-2024-29893.md): Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server (CVSS 6.5)
- [CVE-2024-21662](https://cve.now/CVE-2024-21662.md): Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow (CVSS 7.5)
- [CVE-2024-21661](https://cve.now/CVE-2024-21661.md): Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment (CVSS 7.5)
- [CVE-2024-21652](https://cve.now/CVE-2024-21652.md): Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss (CVSS 9.8)
- [CVE-2023-50726](https://cve.now/CVE-2023-50726.md): Users with \`create\` but not \`override\` privileges can perform local sync in argo-cd (CVSS 6.4)
- [CVE-2024-28175](https://cve.now/CVE-2024-28175.md): Cross-site scripting on application summary component in argo-cd (CVSS 9.1)
- [CVE-2024-22424](https://cve.now/CVE-2024-22424.md): Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd (CVSS 8.4)
- [CVE-2023-40026](https://cve.now/CVE-2023-40026.md): Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server (CVSS 5.0)
- [CVE-2023-40584](https://cve.now/CVE-2023-40584.md): Denial of Service to Argo CD repo-server (CVSS 6.5)
- [CVE-2023-40029](https://cve.now/CVE-2023-40029.md): Cluster secret might leak in cluster details page in Argo CD (CVSS 9.9)
- [CVE-2023-40025](https://cve.now/CVE-2023-40025.md): Argo CD web terminal session doesn't expire (CVSS 4.7)
- [CVE-2023-23947](https://cve.now/CVE-2023-23947.md): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets (CVSS 9.1)
- [CVE-2023-25163](https://cve.now/CVE-2023-25163.md): Argo CD leaks repository credentials in user-facing error messages and in logs (CVSS 6.3)
- [CVE-2023-22736](https://cve.now/CVE-2023-22736.md): argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled (CVSS 8.6)
- [CVE-2023-22482](https://cve.now/CVE-2023-22482.md): JWT audience claim is not verified (CVSS 9.1)
- [CVE-2022-31102](https://cve.now/CVE-2022-31102.md): Cross-site Scripting for Argo CD single sign on users (CVSS 2.6)
- [CVE-2022-31105](https://cve.now/CVE-2022-31105.md): Argo CD's certificate verification is skipped for connections to OIDC providers (CVSS 8.3)
- [CVE-2022-31036](https://cve.now/CVE-2022-31036.md): Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server (CVSS 4.3)
- [CVE-2022-31035](https://cve.now/CVE-2022-31035.md): External URLs for Deployments can include javascript in argo-cd (CVSS 9.0)
- [CVE-2022-31034](https://cve.now/CVE-2022-31034.md): Insecure entropy in argo-cd (CVSS 8.3)
- [CVE-2022-31016](https://cve.now/CVE-2022-31016.md): Argo CD vulnerable to Uncontrolled Memory Consumption (CVSS 6.5)
- [CVE-2022-31054](https://cve.now/CVE-2022-31054.md): Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events (CVSS 7.5)
- [CVE-2022-29165](https://cve.now/CVE-2022-29165.md): Argo CD will blindly trust JWT claims if anonymous access is enabled (CVSS 10.0)
- [CVE-2022-24905](https://cve.now/CVE-2022-24905.md): Argo CD login screen allows message spoofing if SSO is enabled (CVSS 4.3)
- [CVE-2022-24904](https://cve.now/CVE-2022-24904.md): Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (CVSS 4.3)
- [CVE-2022-29164](https://cve.now/CVE-2022-29164.md): Privilege Escalation in argo-workflows (CVSS 7.1)
- [CVE-2022-24768](https://cve.now/CVE-2022-24768.md): Improper access control allows admin privilege escalation in Argo CD (CVSS 9.9)
- [CVE-2022-24731](https://cve.now/CVE-2022-24731.md): Path traversal allows leaking out-of-bound files from Argo CD repo-server (CVSS 6.8)
- [CVE-2022-24730](https://cve.now/CVE-2022-24730.md): Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/argoproj
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.