Argoproj vulnerabilities
74 CVEs and advisories name Argoproj as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-55190Argo CD: Project API Token Exposes Repository Credentials
- CVE-2025-47933Argo CD allows cross-site scripting on repositories page
- CVE-2025-32445Users can gain privileged access to the host system and cluster with EventSource and Sensor CR
- CVE-2025-23216Argo CD does not scrub secret values from patch errors
- CVE-2024-53862Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
- CVE-2024-52814Helm Lacks Granularity in Workflow Role
- CVE-2024-52799Argo Workflows Chart: Excessive Privileges in Workflow Role
- CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon Workflows
- CVE-2024-41666The Argo CD web terminal session does not handle the revocation of user permissions properly.
- CVE-2024-40634Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
- CVE-2024-37152Unauthenticated Access to sensitive settings in Argo CD
- CVE-2024-36106Argo CD allows authenticated users to enumerate clusters by name
- CVE-2024-31989ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
- CVE-2024-32476Denial of Service via malicious jqPathExpressions in ignoreDifferences
- CVE-2024-31990Argo CD' API server does not enforce project sourceNamespaces
- CVE-2024-29893Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
- CVE-2024-21662Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
- CVE-2024-21661Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
- CVE-2024-21652Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
- CVE-2023-50726Users with `create` but not `override` privileges can perform local sync in argo-cd
- CVE-2024-28175Cross-site scripting on application summary component in argo-cd
- CVE-2024-22424Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd
- CVE-2023-40026Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
- CVE-2023-40584Denial of Service to Argo CD repo-server
- CVE-2023-40029Cluster secret might leak in cluster details page in Argo CD
- CVE-2023-40025Argo CD web terminal session doesn't expire
- CVE-2023-23947Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets
- CVE-2023-25163Argo CD leaks repository credentials in user-facing error messages and in logs
- CVE-2023-22736argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
- CVE-2023-22482JWT audience claim is not verified