Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

argo-cd — Vulnerabilities & Security Advisories 44

All 44 CVE vulnerabilities found in argo-cd, with AI-generated Chinese analysis, references, and POCs.

This page details the Common Weakness Enumerations associated with the Argo CD product developed by the Argo project. It aggregates security data relevant to the continuous delivery platform, focusing on vulnerabilities identified within its architecture and deployment configurations. The collection spans from the product's inception to the present, capturing a comprehensive timeline of reported security issues, patches, and advisory notices. Readers can utilize this resource to track vendor advisories for Argo CD, allowing for timely assessment of risk exposure in their environments. Furthermore, the page facilitates a deeper understanding of specific weakness classes that frequently affect Kubernetes-native tools, helping security teams categorize threats by severity and impact. Users may also look up the product's vulnerability history to analyze trends in patching response times and the frequency of critical flaws over recent years. This historical context is essential for evaluating the long-term security posture of the tooling used in modern CI/CD pipelines. By consolidating these disparate data points, the page serves as a central reference for security analysts, DevOps engineers, and compliance officers who need to audit the safety of their Argo CD instances. The information provided is derived from official vendor disclosures and independent security research, ensuring accuracy and reliability for decision-making processes. This structured overview enables stakeholders to make informed choices regarding upgrades, mitigations, and alternative solutions when necessary.

Vendor: argoproj

CVE ID Title CVSS Severity Published
CVE-2026-45737 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations CWE-200 6.3 Medium 2026-07-15
CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CWE-79 7.3 High 2026-07-15
CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CWE-200 9.6 Critical 2026-05-07
CVE-2025-59538 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook CWE-248 7.5 High 2025-10-01
CVE-2025-59537 argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload CWE-20 7.5 High 2025-10-01
CVE-2025-59531 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload CWE-703 7.5 High 2025-10-01
CVE-2025-55191 Repository Credentials Race Condition Crashes Argo CD Server CWE-362 6.5 Medium 2025-09-30
CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials CWE-200 10.0 Critical 2025-09-04
CVE-2025-47933 Argo CD allows cross-site scripting on repositories page CWE-79 9.1 Critical 2025-05-29
CVE-2025-23216 Argo CD does not scrub secret values from patch errors CWE-209 6.8 Medium 2025-01-30
CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly. CWE-269 4.7 Medium 2024-07-24
CVE-2024-40634 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint CWE-400 7.5 High 2024-07-22
CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD CWE-287 5.3 Medium 2024-06-06
CVE-2024-36106 Argo CD allows authenticated users to enumerate clusters by name CWE-209 4.3 Medium 2024-06-06
CVE-2024-31989 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CWE-327 9.1 Critical 2024-05-21
CVE-2024-32476 Denial of Service via malicious jqPathExpressions in ignoreDifferences CWE-400 6.5 Medium 2024-04-26
CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces CWE-863 4.8 Medium 2024-04-15
CVE-2024-29893 Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server CWE-400 6.5 Medium 2024-03-29
CVE-2024-21662 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CWE-307 7.5 High 2024-03-18
CVE-2024-21661 Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment CWE-787 7.5 High 2024-03-18
CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CWE-307 9.8 Critical 2024-03-18
CVE-2023-50726 Users with `create` but not `override` privileges can perform local sync in argo-cd CWE-269 6.4 Medium 2024-03-13
CVE-2024-28175 Cross-site scripting on application summary component in argo-cd CWE-79 9.1 Critical 2024-03-13
CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd CWE-352 8.4 High 2024-01-19
CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server CWE-22 5.0 Medium 2023-09-27
CVE-2023-40584 Denial of Service to Argo CD repo-server CWE-400 6.5 Medium 2023-09-07
CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD CWE-200 9.9 Critical 2023-09-07
CVE-2023-40025 Argo CD web terminal session doesn't expire CWE-613 4.7 Medium 2023-08-23
CVE-2023-23947 Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets CWE-863 9.1 Critical 2023-02-16
CVE-2023-25163 Argo CD leaks repository credentials in user-facing error messages and in logs CWE-532 6.3 Medium 2023-02-08

All 44 known CVE vulnerabilities affecting argo-cd with full Chinese analysis, references, and POCs where available.