github.com/argoproj/argo-cd (Go)
Advisories
100
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.11.3 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/argoproj/argo-cd@v2.11.3 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks |
Critical EPSS 0.50% |
all versions | No fix yet |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL |
High EPSS 1.87% |
all versions | No fix yet |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation |
High EPSS 0.61% |
<= 1.8.7 | No fix yet |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation |
High EPSS 0.61% |
all versions | No fix yet |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations |
Medium EPSS 0.52% |
all versions | No fix yet |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction |
Critical EPSS 0.84% |
all versions | No fix yet |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook |
High EPSS 9.36% |
all versions | No fix yet |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload |
High EPSS 0.60% |
>= 1.2.0, <= 1.8.7 | No fix yet |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload |
High EPSS 0.60% |
>= 1.2.0 | No fix yet |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload |
High EPSS 0.59% |
>= 1.2.0, <= 1.8.7 | No fix yet |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload |
High EPSS 0.59% |
>= 1.2.0 | No fix yet |
| GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server |
Medium EPSS 0.48% |
all versions | No fix yet |
| GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials |
Critical EPSS 5.66% |
all versions | No fix yet |
| GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page |
Medium EPSS 0.49% |
>= 1.2.0-rc1, <= 1.8.7 | No fix yet |
| GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page |
Medium EPSS 0.49% |
>= 1.2.0-rc1 | No fix yet |
| GHSA-47g2-qmh2-749v Argo CD does not scrub secret values from patch errors |
Medium EPSS 0.47% |
<= 1.8.7 | No fix yet |
| GHSA-47g2-qmh2-749v Argo CD does not scrub secret values from patch errors |
Medium EPSS 0.47% |
all versions | No fix yet |
| GHSA-v8wx-v5jq-qhhw The Argo CD web terminal session does not handle the revocation of user permissions properly |
Medium EPSS 0.69% |
all versions | No fix yet |
| GHSA-jmvp-698c-4x3w Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint |
High EPSS 1.39% |
>= 1.0.0, <= 1.8.7 | No fix yet |
| GHSA-jmvp-698c-4x3w Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint |
High EPSS 1.39% |
>= 1.0.0 | No fix yet |
| GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD |
High EPSS 2.35% |
all versions | No fix yet |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name |
Medium EPSS 0.41% |
>= 2.11.0, < 2.11.3 | 2.11.3 |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name |
Medium EPSS 0.41% |
>= 2.10.0, < 2.10.12 | 2.10.12 |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name |
Medium EPSS 0.41% |
>= 0.11.0, < 2.9.17 | 2.9.17 |
| GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name |
Medium EPSS 0.41% |
>= 0.11.0 | No fix yet |
| GHSA-9766-5277-j5hr ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache |
Critical EPSS 1.48% |
all versions | No fix yet |
| GHSA-9766-5277-j5hr ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache |
Critical EPSS 1.48% |
<= 1.8.7 | No fix yet |
| GHSA-9m6p-x4h2-6frq Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences |
Medium EPSS 1.00% |
all versions | No fix yet |
| GHSA-2gvw-w6fj-7m3c Argo CD's API server does not enforce project sourceNamespaces |
Medium EPSS 0.45% |
all versions | No fix yet |
| GHSA-6v85-wr92-q4p7 Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment |
High EPSS 1.18% |
<= 1.8.7 | No fix yet |
| GHSA-jwv5-8mqv-g387 Cross-site scripting on application summary component |
Medium EPSS 0.65% |
>= 1.0.0, <= 1.8.7 | No fix yet |
| GHSA-jwv5-8mqv-g387 Cross-site scripting on application summary component |
Medium EPSS 0.65% |
>= 1.0.0 | No fix yet |
| GHSA-g623-jcgg-mhmm Users with `create` but not `override` privileges can perform local sync |
Medium EPSS 0.53% |
>= 1.2.0-rc1, <= 1.8.7 | No fix yet |
| GHSA-g623-jcgg-mhmm Users with `create` but not `override` privileges can perform local sync |
Medium EPSS 0.53% |
>= 1.2.0-rc1 | No fix yet |
| GHSA-92mw-q256-5vwg github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability |
High EPSS 0.48% |
>= 0.1.0, <= 1.8.7 | No fix yet |
| GHSA-6jqw-jwf5-rp8h Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server |
Medium EPSS 0.61% |
<= 1.8.7 | No fix yet |
| GHSA-6jqw-jwf5-rp8h Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server |
Medium EPSS 0.61% |
all versions | No fix yet |
| GHSA-g687-f2gx-6wm8 Argo CD repo-server Denial of Service vulnerability |
Medium EPSS 1.42% |
all versions | No fix yet |
| GHSA-fwr2-64vr-xv9m Argo CD cluster secret might leak in cluster details page |
Critical EPSS 1.20% |
all versions | No fix yet |
| GHSA-c8xw-vjgf-94hr Argo CD web terminal session doesn't expire |
High EPSS 0.57% |
all versions | No fix yet |
| GHSA-2q5c-qw9c-fmvq Argo CD authenticated but unauthorized users may enumerate Application names via the API |
Medium EPSS 0.64% |
>= 0.5.0 | No fix yet |
| GHSA-2q5c-qw9c-fmvq Argo CD authenticated but unauthorized users may enumerate Application names via the API |
Medium EPSS 0.64% |
>= 0.5.0, <= 1.8.7 | No fix yet |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets |
High EPSS 0.67% |
>= 2.6.0, < 2.6.2 | 2.6.2 |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets |
High EPSS 0.67% |
>= 2.3.0, < 2.3.17 | 2.3.17 |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets |
High EPSS 0.67% |
>= 2.4.0, < 2.4.23 | 2.4.23 |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets |
High EPSS 0.67% |
>= 2.5.0, < 2.5.11 | 2.5.11 |
| GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets |
High EPSS 0.67% |
all versions | No fix yet |
| GO-2023-1520 JWT audience claim is not verified |
High EPSS 0.88% |
>= 1.8.2 | No fix yet |
| GO-2023-1520 JWT audience claim is not verified |
High EPSS 0.88% |
>= 2.6.0-rc1, < 2.6.0-rc5 | 2.6.0-rc5 |
| GO-2023-1520 JWT audience claim is not verified |
High EPSS 0.88% |
>= 2.4.0, < 2.4.20 | 2.4.20 |
| GO-2023-1520 JWT audience claim is not verified |
High EPSS 0.88% |
>= 1.8.2, < 2.3.14 | 2.3.14 |
| GO-2023-1520 JWT audience claim is not verified |
High EPSS 0.88% |
>= 2.5.0, < 2.5.8 | 2.5.8 |
| GHSA-6p4m-hw2h-6gmw Controller reconciles apps outside configured namespaces when sharding is enabled |
High EPSS 0.78% |
all versions | No fix yet |
| GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting |
Medium EPSS 0.63% |
>= 2.3.0, < 2.3.6 | 2.3.6 |
| GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting |
Medium EPSS 0.63% |
>= 2.4.0, < 2.4.5 | 2.4.5 |
| GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting |
Medium EPSS 0.63% |
all versions | No fix yet |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers |
Critical EPSS 0.81% |
>= 0.4.0, < 2.2.11 | 2.2.11 |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers |
Critical EPSS 0.81% |
>= 0.4.0 | No fix yet |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers |
Critical EPSS 0.81% |
>= 2.4.0, < 2.4.5 | 2.4.5 |
| GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers |
Critical EPSS 0.81% |
>= 2.3.0, < 2.3.6 | 2.3.6 |
| GHSA-jhqp-vf4w-rpwq DoS through large manifest files in Argo CD |
Medium EPSS 0.90% |
>= 0.7.0 | No fix yet |
| GHSA-jhqp-vf4w-rpwq DoS through large manifest files in Argo CD |
Medium EPSS 0.90% |
>= 0.7.0, < 2.1.16 | 2.1.16 |
| GHSA-q4w5-4gq2-98vm Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server |
Medium EPSS 0.89% |
>= 1.3.0 | No fix yet |
| GHSA-q4w5-4gq2-98vm Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server |
Medium EPSS 0.89% |
>= 1.3.0, < 2.1.16 | 2.1.16 |
| GHSA-h4w9-6x78-8vrj Argo CD's external URLs for Deployments can include JavaScript |
Medium EPSS 0.99% |
>= 1.0.0 | No fix yet |
| GHSA-h4w9-6x78-8vrj Argo CD's external URLs for Deployments can include JavaScript |
Medium EPSS 0.99% |
>= 1.0.0, < 2.1.16 | 2.1.16 |
| GHSA-2m7h-86qq-fp4v Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params |
High EPSS 0.96% |
>= 0.11.0 | No fix yet |
| GHSA-2m7h-86qq-fp4v Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params |
High EPSS 0.96% |
>= 0.11.0, < 2.1.16 | 2.1.16 |
| GHSA-xj7v-c82w-92q2 Argo Exposure of Sensitive Information |
Medium EPSS 1.37% |
< 1.5.0-rc1 | 1.5.0-rc1 |
| GHSA-xj7v-c82w-92q2 Argo Exposure of Sensitive Information |
Medium EPSS 1.37% |
< 1.5.0-rc1 | 1.5.0-rc1 |
| GHSA-r642-gv9p-2wjj Argo CD will blindly trust JWT claims if anonymous access is enabled |
Critical EPSS 2.10% |
all versions | No fix yet |
| GHSA-r642-gv9p-2wjj Argo CD will blindly trust JWT claims if anonymous access is enabled |
Critical EPSS 2.10% |
< 2.1.15 | 2.1.15 |
| GHSA-xmg8-99r8-jc2j Login screen allows message spoofing if SSO is enabled |
Medium EPSS 1.30% |
all versions | No fix yet |
| GHSA-xmg8-99r8-jc2j Login screen allows message spoofing if SSO is enabled |
Medium EPSS 1.30% |
< 2.1.15 | 2.1.15 |
| GHSA-6gcg-hp2x-q54h Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server |
Medium EPSS 1.15% |
all versions | No fix yet |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 0.5.0, <= 1.8.7 | No fix yet |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 0.5.0 | No fix yet |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 0.5.0 | No fix yet |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 2.3.0, < 2.3.2 | 2.3.2 |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 2.2.0, < 2.2.8 | 2.2.8 |
| GHSA-96jv-vj39-x4j6 Improper access control allows admin privilege escalation in Argo CD |
High EPSS 1.34% |
>= 0.5.0, < 2.1.14 | 2.1.14 |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.96% |
>= 2.2.0, < 2.2.6 | 2.2.6 |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.96% |
>= 1.5.0, < 2.1.11 | 2.1.11 |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.96% |
>= 1.5.0 | No fix yet |
| GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.96% |
>= 2.3.0-rc1, < 2.3.0 | 2.3.0 |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.90% |
>= 2.3.0-rc1, < 2.3.0 | 2.3.0 |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.90% |
>= 1.3.0 | No fix yet |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.90% |
>= 1.3.0, < 2.1.11 | 2.1.11 |
| GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server |
Medium EPSS 0.90% |
>= 2.2.0, < 2.2.6 | 2.2.6 |
| GHSA-63qx-x74g-jcr7 Path traversal and dereference of symlinks in Argo CD |
High EPSS 2.77% |
< 2.1.9 | 2.1.9 |
| GHSA-63qx-x74g-jcr7 Path traversal and dereference of symlinks in Argo CD |
High EPSS 2.77% |
all versions | No fix yet |
| GHSA-vj54-cjrx-x696 Observable Discrepancy in Argo |
Medium EPSS 1.97% |
>= 1.5.0, < 1.5.1 | 1.5.1 |
| GHSA-vj54-cjrx-x696 Observable Discrepancy in Argo |
Medium EPSS 1.97% |
>= 1.5.0, < 1.5.1 | 1.5.1 |
| GHSA-xcqr-9h24-vrgw Improper Restriction of Excessive Authentication Attempts in Argo API |
High EPSS 2.21% |
< 1.5.1 | 1.5.1 |
| GHSA-xcqr-9h24-vrgw Improper Restriction of Excessive Authentication Attempts in Argo API |
High EPSS 2.21% |
< 1.5.1 | 1.5.1 |
| GHSA-h8jc-jmrf-9h8f Argo CD Insecure default administrative password |
High EPSS 1.80% |
<= 1.8.0 | No fix yet |
| GHSA-qq5v-f4c3-395c Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2 |
Medium EPSS 0.59% |
< 1.7.13>= 1.8.0, < 1.8.6 | 1.7.131.8.6 |
| GHSA-6w87-g839-9wv7 Helm OCI credentials leaked into Argo CD logs |
Medium | < 1.7.14 | 1.7.14 |
| GHSA-6w87-g839-9wv7 Helm OCI credentials leaked into Argo CD logs |
Medium | >= 1.8.0, < 1.8.7 | 1.8.7 |
| GHSA-6w87-g839-9wv7 Helm OCI credentials leaked into Argo CD logs |
Medium | < 1.7.14>= 1.8.0, < 1.8.7 | 1.7.141.8.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor