GHSA-6w87-g839-9wv7 GO-2022-0387
Helm OCI credentials leaked into Argo CD logs
- Severity
- 6.6 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
- Fix
1.7.14- Upgrade github.com/argoproj/argo-cd to this version or later
Description
Impact
When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged.
Anyone with access to the pod logs - either via access with appropriate permissions to the Kubernetes control plane or a third party log management system where the logs from Argo CD were aggregated - could have potentially obtained the credentials to the Helm OCI repository.
If you are using Helm OCI repositories with Argo CD, it is strongly recommended to upgrade Argo CD to the latest patch version and to change the credentials used to access the repositories.
Patches
A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.
Workarounds
No workaround available
References
N/A
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Argo CD issue tracker or discussions
- Join us on Slack in channel
#argo-cd
Credits
This vulnerability was found and reported by a third-party who wishes to stay anonymous. We want to thank this third-party for disclosing this vulnerability to us in a responsible manner.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/argoproj/argo-cd | < 1.7.14 |
1.7.14 |
| github.com/argoproj/argo-cd | >= 1.8.0, < 1.8.7 |
1.8.7 |
| github.com/argoproj/argo-cd | < 1.7.14>= 1.8.0, < 1.8.7 |
1.7.141.8.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/argoproj/argo-cd Go → 1.7.14
- go
go get github.com/argoproj/argo-cd@v1.7.14 && go mod tidy
Severity breakdown
CVSS 3.1 6.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | High | Also affects github.com/argoproj/argo-cd |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | High | Also affects github.com/argoproj/argo-cd |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations | Medium | Also affects github.com/argoproj/argo-cd |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | High | Also affects github.com/argoproj/argo-cd |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | High | Also affects github.com/argoproj/argo-cd |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | High | Also affects github.com/argoproj/argo-cd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor