Skip to content
Log inStart free trial

github.com/argoproj/argo-cd/v2 (Go)

Advisories
148
Latest version
—
License
—
OpenSSF Scorecard
—

How to fix

Upgrading to 2.14.20 or later clears every advisory below that has a fix.

Upgrade commands
go
go get github.com/argoproj/argo-cd/v2@v2.14.20 && go mod tidy

Known vulnerabilities

AdvisorySeverityAffectedFixed in
GHSA-fmxq-cgp8-87wp
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
 Critical
EPSS 0.50%
>= 2.10.0, <= 2.14.21
No fix yet
GHSA-fmxq-cgp8-87wp
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
 Critical
EPSS 0.50%
>= 2.10.0
No fix yet
GHSA-j6cw-g6p4-7hch
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
 High
EPSS 1.87%
>= 2.11.0
No fix yet
GHSA-j6cw-g6p4-7hch
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
 High
EPSS 1.87%
>= 2.11.0, <= 2.14.21
No fix yet
GHSA-h98r-wv3h-fr38
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
 High
EPSS 0.61%
all versions
No fix yet
GHSA-h98r-wv3h-fr38
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
 High
EPSS 0.61%
<= 2.14.21
No fix yet
GO-2026-5618
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
 Medium
EPSS 0.52%
all versions
No fix yet
GO-2026-5099
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
 Critical
EPSS 0.84%
all versions
No fix yet
GHSA-gpx4-37g2-c8pv
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
 High
EPSS 9.36%
>= 2.9.0-rc1, < 2.14.20
2.14.20
GHSA-gpx4-37g2-c8pv
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
 High
EPSS 9.36%
>= 2.9.0-rc1, < 2.14.20
2.14.20
GHSA-wp4p-9pxh-cgx2
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
 High
EPSS 0.60%
< 2.14.20
2.14.20
GHSA-wp4p-9pxh-cgx2
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
 High
EPSS 0.60%
>= 2.0.0-rc1, < 2.14.20
2.14.20
GHSA-f9gq-prrc-hrhc
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
 High
EPSS 0.59%
< 2.14.20
2.14.20
GHSA-f9gq-prrc-hrhc
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
 High
EPSS 0.59%
>= 2.0.0-rc1, < 2.14.20
2.14.20
GHSA-g88p-r42r-ppp9
Repository Credentials Race Condition Crashes Argo CD Server
 Medium
EPSS 0.48%
>= 2.1.0, < 2.14.20
2.14.20
GHSA-g88p-r42r-ppp9
Repository Credentials Race Condition Crashes Argo CD Server
 Medium
EPSS 0.48%
>= 2.1.0, < 2.14.20
2.14.20
GHSA-786q-9hcg-v9ff
Argo CD's Project API Token Exposes Repository Credentials
 Critical
EPSS 5.66%
>= 2.13.0, < 2.13.9
>= 2.14.0, < 2.14.16
2.13.9
2.14.16
GHSA-786q-9hcg-v9ff
Argo CD's Project API Token Exposes Repository Credentials
 Critical
EPSS 5.66%
>= 2.14.0, < 2.14.16
2.14.16
GHSA-786q-9hcg-v9ff
Argo CD's Project API Token Exposes Repository Credentials
 Critical
EPSS 5.66%
>= 2.13.0, < 2.13.9
2.13.9
GHSA-2hj5-g64g-fp6p
Argo CD allows cross-site scripting on repositories page
 Medium
EPSS 0.49%
>= 2.0.0-rc3, < 2.13.8
2.13.8
GHSA-2hj5-g64g-fp6p
Argo CD allows cross-site scripting on repositories page
 Medium
EPSS 0.49%
>= 2.14.0-rc1, < 2.14.13
2.14.13
GHSA-2hj5-g64g-fp6p
Argo CD allows cross-site scripting on repositories page
 Medium
EPSS 0.49%
>= 2.0.0-rc3, < 2.13.8
>= 2.14.0-rc1, < 2.14.13
2.13.8
2.14.13
GHSA-47g2-qmh2-749v
Argo CD does not scrub secret values from patch errors
 Medium
EPSS 0.47%
< 2.11.13
>= 2.12.0, < 2.12.10
>= 2.13.0, < 2.13.4
2.11.13
2.12.10
2.13.4
GHSA-47g2-qmh2-749v
Argo CD does not scrub secret values from patch errors
 Medium
EPSS 0.47%
>= 2.13.0, < 2.13.4
2.13.4
GHSA-47g2-qmh2-749v
Argo CD does not scrub secret values from patch errors
 Medium
EPSS 0.47%
>= 2.12.0, < 2.12.10
2.12.10
GHSA-47g2-qmh2-749v
Argo CD does not scrub secret values from patch errors
 Medium
EPSS 0.47%
< 2.11.13
2.11.13
GHSA-v8wx-v5jq-qhhw
The Argo CD web terminal session does not handle the revocation of user permissions properly
 Medium
EPSS 0.69%
>= 2.6.0, < 2.9.21
2.9.21
GHSA-v8wx-v5jq-qhhw
The Argo CD web terminal session does not handle the revocation of user permissions properly
 Medium
EPSS 0.69%
>= 2.10.0, < 2.10.16
2.10.16
GHSA-v8wx-v5jq-qhhw
The Argo CD web terminal session does not handle the revocation of user permissions properly
 Medium
EPSS 0.69%
>= 2.11.0, < 2.11.7
2.11.7
GHSA-v8wx-v5jq-qhhw
The Argo CD web terminal session does not handle the revocation of user permissions properly
 Medium
EPSS 0.69%
>= 2.6.0, < 2.9.21
>= 2.10.0, < 2.10.16
>= 2.11.0, < 2.11.7
2.9.21
2.10.16
2.11.7
GHSA-jmvp-698c-4x3w
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
 High
EPSS 1.39%
< 2.9.20
2.9.20
GHSA-jmvp-698c-4x3w
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
 High
EPSS 1.39%
>= 2.10.0, < 2.10.15
2.10.15
GHSA-jmvp-698c-4x3w
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
 High
EPSS 1.39%
>= 2.11.0, < 2.11.6
2.11.6
GHSA-jmvp-698c-4x3w
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
 High
EPSS 1.39%
< 2.9.20
>= 2.10.0, < 2.10.15
>= 2.11.0, < 2.11.6
2.9.20
2.10.15
2.11.6
GO-2024-2902
Unauthenticated Access to sensitive settings in Argo CD
 High
EPSS 2.35%
>= 2.9.3, < 2.9.17
>= 2.10.0, < 2.10.12
>= 2.11.0, < 2.11.3
2.9.17
2.10.12
2.11.3
GO-2024-2898
Argo-cd authenticated users can enumerate clusters by name
 Medium
EPSS 0.41%
< 2.9.17
>= 2.10.0, < 2.10.12
>= 2.11.0, < 2.11.3
2.9.17
2.10.12
2.11.3
GHSA-9766-5277-j5hr
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
 Critical
EPSS 1.48%
< 2.8.19
>= 2.9.0-rc1, < 2.9.15
>= 2.10.0-rc1, < 2.10.10
>= 2.11.0-rc1, < 2.11.1
2.8.19
2.9.15
2.10.10
2.11.1
GHSA-9766-5277-j5hr
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
 Critical
EPSS 1.48%
>= 2.11.0-rc1, < 2.11.1
2.11.1
GHSA-9766-5277-j5hr
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
 Critical
EPSS 1.48%
>= 2.10.0-rc1, < 2.10.10
2.10.10
GHSA-9766-5277-j5hr
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
 Critical
EPSS 1.48%
>= 2.9.0-rc1, < 2.9.15
2.9.15
GHSA-9766-5277-j5hr
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
 Critical
EPSS 1.48%
< 2.8.19
2.8.19
GHSA-9m6p-x4h2-6frq
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
 Medium
EPSS 1.00%
>= 2.10.0, < 2.10.8
2.10.8
GHSA-9m6p-x4h2-6frq
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
 Medium
EPSS 1.00%
>= 2.9.0, < 2.9.13
2.9.13
GHSA-9m6p-x4h2-6frq
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
 Medium
EPSS 1.00%
< 2.8.17
2.8.17
GHSA-9m6p-x4h2-6frq
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
 Medium
EPSS 1.00%
< 2.8.17
>= 2.9.0, < 2.9.13
>= 2.10.0, < 2.10.8
2.8.17
2.9.13
2.10.8
GHSA-2gvw-w6fj-7m3c
Argo CD's API server does not enforce project sourceNamespaces
 Medium
EPSS 0.45%
>= 2.4.0, < 2.8.16
>= 2.9.0, < 2.9.12
>= 2.10.0, < 2.10.7
2.8.16
2.9.12
2.10.7
GHSA-2gvw-w6fj-7m3c
Argo CD's API server does not enforce project sourceNamespaces
 Medium
EPSS 0.45%
>= 2.4.0, < 2.8.16
2.8.16
GHSA-2gvw-w6fj-7m3c
Argo CD's API server does not enforce project sourceNamespaces
 Medium
EPSS 0.45%
>= 2.9.0, < 2.9.12
2.9.12
GHSA-2gvw-w6fj-7m3c
Argo CD's API server does not enforce project sourceNamespaces
 Medium
EPSS 0.45%
>= 2.10.0, < 2.10.7
2.10.7
GHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
 Medium
EPSS 0.97%
>= 2.4.0, < 2.8.14
>= 2.9.0, < 2.9.10
>= 2.10.0, < 2.10.5
2.8.14
2.9.10
2.10.5
GHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
 Medium
EPSS 0.97%
>= 2.9.0, < 2.9.10
2.9.10
GHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
 Medium
EPSS 0.97%
>= 2.10.0, < 2.10.5
2.10.5
GHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
 Medium
EPSS 0.97%
>= 2.4.0, < 2.8.14
2.8.14
GHSA-6v85-wr92-q4p7
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
 High
EPSS 1.18%
>= 2.10.0, < 2.10.4
2.10.4
GHSA-6v85-wr92-q4p7
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
 High
EPSS 1.18%
< 2.8.13
2.8.13
GHSA-6v85-wr92-q4p7
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
 High
EPSS 1.18%
< 2.8.13
>= 2.9.0, < 2.9.9
>= 2.10.0, < 2.10.4
2.8.13
2.9.9
2.10.4
GHSA-6v85-wr92-q4p7
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
 High
EPSS 1.18%
>= 2.9.0, < 2.9.9
2.9.9
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
>= 2.9.0, < 2.9.9
2.9.9
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
< 2.8.13
2.8.13
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
>= 2.10.0, < 2.10.4
2.10.4
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
>= 2.9.0, < 2.9.9
2.9.9
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
< 2.8.13
2.8.13
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
< 2.8.13
>= 2.9.0, < 2.9.9
>= 2.10.0, < 2.10.4
2.8.13
2.9.9
2.10.4
GHSA-2vgg-9h6w-m454
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
 Critical
EPSS 0.84%
>= 2.10.0, < 2.10.4
2.10.4
GHSA-jwv5-8mqv-g387
Cross-site scripting on application summary component
 Medium
EPSS 0.65%
>= 2.10.0, < 2.10.3
2.10.3
GHSA-jwv5-8mqv-g387
Cross-site scripting on application summary component
 Medium
EPSS 0.65%
>= 2.9.0, < 2.9.8
2.9.8
GHSA-jwv5-8mqv-g387
Cross-site scripting on application summary component
 Medium
EPSS 0.65%
>= 2.0.0, < 2.8.12
>= 2.9.0, < 2.9.8
>= 2.10.0, < 2.10.3
2.8.12
2.9.8
2.10.3
GHSA-jwv5-8mqv-g387
Cross-site scripting on application summary component
 Medium
EPSS 0.65%
>= 2.0.0, < 2.8.12
2.8.12
GHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
 Medium
EPSS 0.53%
>= 2.10.0, < 2.10.3
2.10.3
GHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
 Medium
EPSS 0.53%
>= 2.9.0, < 2.9.8
2.9.8
GHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
 Medium
EPSS 0.53%
>= 2.0.0, < 2.8.12
>= 2.9.0, < 2.9.8
>= 2.10.0, < 2.10.3
2.8.12
2.9.8
2.10.3
GHSA-g623-jcgg-mhmm
Users with `create` but not `override` privileges can perform local sync
 Medium
EPSS 0.53%
>= 2.0.0-rc3, < 2.8.12
2.8.12
GHSA-92mw-q256-5vwg
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
 High
EPSS 0.48%
>= 2.9.0-rc1, < 2.9.4
2.9.4
GHSA-92mw-q256-5vwg
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
 High
EPSS 0.48%
>= 2.10.0-rc1, < 2.10-rc2
2.10-rc2
GHSA-92mw-q256-5vwg
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
 High
EPSS 0.48%
>= 2.8.0-rc1, < 2.8.8
2.8.8
GHSA-92mw-q256-5vwg
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
 High
EPSS 0.48%
< 2.7.16
2.7.16
GHSA-6jqw-jwf5-rp8h
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
 Medium
EPSS 0.61%
< 2.3.0
2.3.0
GHSA-6jqw-jwf5-rp8h
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
 Medium
EPSS 0.61%
< 2.3.0
2.3.0
GHSA-g687-f2gx-6wm8
Argo CD repo-server Denial of Service vulnerability
 Medium
EPSS 1.42%
>= 2.7.0, < 2.7.14
2.7.14
GHSA-g687-f2gx-6wm8
Argo CD repo-server Denial of Service vulnerability
 Medium
EPSS 1.42%
>= 2.4.0, < 2.6.15
>= 2.7.0, < 2.7.14
>= 2.8.0, < 2.8.3
2.6.15
2.7.14
2.8.3
GHSA-g687-f2gx-6wm8
Argo CD repo-server Denial of Service vulnerability
 Medium
EPSS 1.42%
>= 2.8.0, < 2.8.3
2.8.3
GHSA-g687-f2gx-6wm8
Argo CD repo-server Denial of Service vulnerability
 Medium
EPSS 1.42%
>= 2.4.0, < 2.6.15
2.6.15
GHSA-fwr2-64vr-xv9m
Argo CD cluster secret might leak in cluster details page
 Critical
EPSS 1.20%
>= 2.7.0, < 2.7.14
2.7.14
GHSA-fwr2-64vr-xv9m
Argo CD cluster secret might leak in cluster details page
 Critical
EPSS 1.20%
>= 2.2.0, < 2.6.15
>= 2.7.0, < 2.7.14
>= 2.8.0, < 2.8.3
2.6.15
2.7.14
2.8.3
GHSA-fwr2-64vr-xv9m
Argo CD cluster secret might leak in cluster details page
 Critical
EPSS 1.20%
>= 2.2.0, < 2.6.15
2.6.15
GHSA-fwr2-64vr-xv9m
Argo CD cluster secret might leak in cluster details page
 Critical
EPSS 1.20%
>= 2.8.0, < 2.8.3
2.8.3
GHSA-c8xw-vjgf-94hr
Argo CD web terminal session doesn't expire
 High
EPSS 0.57%
>= 2.8.0, < 2.8.1
2.8.1
GHSA-c8xw-vjgf-94hr
Argo CD web terminal session doesn't expire
 High
EPSS 0.57%
>= 2.7.0, < 2.7.12
2.7.12
GHSA-c8xw-vjgf-94hr
Argo CD web terminal session doesn't expire
 High
EPSS 0.57%
>= 2.6.0, < 2.6.14
>= 2.7.0, < 2.7.12
>= 2.8.0, < 2.8.1
2.6.14
2.7.12
2.8.1
GHSA-c8xw-vjgf-94hr
Argo CD web terminal session doesn't expire
 High
EPSS 0.57%
>= 2.6.0, < 2.6.14
2.6.14
GHSA-c8xw-vjgf-94hr
Argo CD web terminal session doesn't expire
 High
EPSS 0.57%
>= 2.0.0-20230718200744-12a5a7a70d6e, < 2.0.0-20230821201509-e047efa8f951
2.0.0-20230821201509-e047efa8f951
GHSA-2q5c-qw9c-fmvq
Argo CD authenticated but unauthorized users may enumerate Application names via the API
 Medium
EPSS 0.64%
>= 2.6.0, < 2.6.7
2.6.7
GHSA-2q5c-qw9c-fmvq
Argo CD authenticated but unauthorized users may enumerate Application names via the API
 Medium
EPSS 0.64%
>= 2.5.0, < 2.5.16
2.5.16
GHSA-2q5c-qw9c-fmvq
Argo CD authenticated but unauthorized users may enumerate Application names via the API
 Medium
EPSS 0.64%
< 2.4.28
>= 2.5.0, < 2.5.16
>= 2.6.0, < 2.6.7
2.4.28
2.5.16
2.6.7
GHSA-2q5c-qw9c-fmvq
Argo CD authenticated but unauthorized users may enumerate Application names via the API
 Medium
EPSS 0.64%
< 2.4.28
2.4.28
GO-2023-1577
Users with any cluster secret update access may update out-of-bounds cluster secrets
 High
EPSS 0.67%
>= 2.3.0, < 2.3.17
>= 2.4.0, < 2.4.23
>= 2.5.0, < 2.5.11
>= 2.6.0, < 2.6.2
2.3.17
2.4.23
2.5.11
2.6.2
GHSA-mv6w-j4xc-qpfw
Argo CD leaks repository credentials in user-facing error messages and in logs
 Medium
EPSS 0.84%
>= 2.6.0-rc1, < 2.6.1
2.6.1
GHSA-mv6w-j4xc-qpfw
Argo CD leaks repository credentials in user-facing error messages and in logs
 Medium
EPSS 0.84%
>= 2.6.0-rc1, < 2.6.1
2.6.1
GO-2023-1520
JWT audience claim is not verified
 High
EPSS 0.88%
< 2.3.14
>= 2.4.0, < 2.4.20
>= 2.5.0, < 2.5.8
>= 2.6.0-rc1, < 2.6.0-rc5
2.3.14
2.4.20
2.5.8
2.6.0-rc5
GHSA-6p4m-hw2h-6gmw
Controller reconciles apps outside configured namespaces when sharding is enabled
 High
EPSS 0.78%
>= 2.6.0-rc4, < 2.6.0-rc5
2.6.0-rc5
GHSA-6p4m-hw2h-6gmw
Controller reconciles apps outside configured namespaces when sharding is enabled
 High
EPSS 0.78%
>= 2.5.0-rc1, < 2.5.8
>= 2.6.0-rc4, < 2.6.0-rc5
2.5.8
2.6.0-rc5
GHSA-6p4m-hw2h-6gmw
Controller reconciles apps outside configured namespaces when sharding is enabled
 High
EPSS 0.78%
>= 2.5.0-rc1, < 2.5.8
2.5.8
GO-2022-0517
Argo CD SSO users vulnerable to Cross-site Scripting
 Medium
EPSS 0.63%
>= 2.3.0, < 2.3.6
>= 2.4.0, < 2.4.5
2.3.6
2.4.5
GO-2022-0518
Argo CD certificate verification is skipped for connections to OIDC providers
 Critical
EPSS 0.81%
< 2.2.11
>= 2.3.0, < 2.3.6
>= 2.4.0, < 2.4.5
2.2.11
2.3.6
2.4.5
GHSA-jhqp-vf4w-rpwq
DoS through large manifest files in Argo CD
 Medium
EPSS 0.90%
< 2.1.16
2.1.16
GHSA-jhqp-vf4w-rpwq
DoS through large manifest files in Argo CD
 Medium
EPSS 0.90%
>= 2.3.0, < 2.3.5
2.3.5
GHSA-jhqp-vf4w-rpwq
DoS through large manifest files in Argo CD
 Medium
EPSS 0.90%
>= 2.2.0, < 2.2.10
2.2.10
GHSA-jhqp-vf4w-rpwq
DoS through large manifest files in Argo CD
 Medium
EPSS 0.90%
< 2.1.16
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.1
2.1.16
2.2.10
2.3.5
2.4.1
GHSA-jhqp-vf4w-rpwq
DoS through large manifest files in Argo CD
 Medium
EPSS 0.90%
>= 2.4.0, < 2.4.1
2.4.1
GHSA-q4w5-4gq2-98vm
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
 Medium
EPSS 0.89%
>= 2.3.0, < 2.3.5
2.3.5
GHSA-q4w5-4gq2-98vm
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
 Medium
EPSS 0.89%
>= 2.2.0, < 2.2.10
2.2.10
GHSA-q4w5-4gq2-98vm
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
 Medium
EPSS 0.89%
< 2.1.16
2.1.16
GHSA-q4w5-4gq2-98vm
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
 Medium
EPSS 0.89%
< 2.1.16
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.1
2.1.16
2.2.10
2.3.5
2.4.1
GHSA-q4w5-4gq2-98vm
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
 Medium
EPSS 0.89%
>= 2.4.0, < 2.4.1
2.4.1
GHSA-h4w9-6x78-8vrj
Argo CD's external URLs for Deployments can include JavaScript
 Medium
EPSS 0.99%
>= 2.4.0, < 2.4.1
2.4.1
GHSA-h4w9-6x78-8vrj
Argo CD's external URLs for Deployments can include JavaScript
 Medium
EPSS 0.99%
< 2.1.16
2.1.16
GHSA-h4w9-6x78-8vrj
Argo CD's external URLs for Deployments can include JavaScript
 Medium
EPSS 0.99%
>= 2.2.0, < 2.2.10
2.2.10
GHSA-h4w9-6x78-8vrj
Argo CD's external URLs for Deployments can include JavaScript
 Medium
EPSS 0.99%
< 2.1.16
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.1
2.1.16
2.2.10
2.3.5
2.4.1
GHSA-h4w9-6x78-8vrj
Argo CD's external URLs for Deployments can include JavaScript
 Medium
EPSS 0.99%
>= 2.3.0, < 2.3.5
2.3.5
GHSA-2m7h-86qq-fp4v
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
 High
EPSS 0.96%
>= 2.2.0, < 2.2.10
2.2.10
GHSA-2m7h-86qq-fp4v
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
 High
EPSS 0.96%
< 2.1.16
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.1
2.1.16
2.2.10
2.3.5
2.4.1
GHSA-2m7h-86qq-fp4v
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
 High
EPSS 0.96%
>= 2.4.0, < 2.4.1
2.4.1
GHSA-2m7h-86qq-fp4v
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
 High
EPSS 0.96%
>= 2.3.0, < 2.3.5
2.3.5
GHSA-2m7h-86qq-fp4v
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
 High
EPSS 0.96%
< 2.1.16
2.1.16
GHSA-r642-gv9p-2wjj
Argo CD will blindly trust JWT claims if anonymous access is enabled
 Critical
EPSS 2.10%
< 2.1.15
2.1.15
GHSA-r642-gv9p-2wjj
Argo CD will blindly trust JWT claims if anonymous access is enabled
 Critical
EPSS 2.10%
>= 2.3.0, < 2.3.4
2.3.4
GHSA-r642-gv9p-2wjj
Argo CD will blindly trust JWT claims if anonymous access is enabled
 Critical
EPSS 2.10%
>= 2.2.0, < 2.2.9
2.2.9
GHSA-r642-gv9p-2wjj
Argo CD will blindly trust JWT claims if anonymous access is enabled
 Critical
EPSS 2.10%
< 2.1.15
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.4
2.1.15
2.2.9
2.3.4
GHSA-xmg8-99r8-jc2j
Login screen allows message spoofing if SSO is enabled
 Medium
EPSS 1.30%
>= 2.0.0, < 2.1.15
2.1.15
GHSA-xmg8-99r8-jc2j
Login screen allows message spoofing if SSO is enabled
 Medium
EPSS 1.30%
>= 2.2.0, < 2.2.9
2.2.9
GHSA-xmg8-99r8-jc2j
Login screen allows message spoofing if SSO is enabled
 Medium
EPSS 1.30%
>= 2.3.0, < 2.3.4
2.3.4
GHSA-xmg8-99r8-jc2j
Login screen allows message spoofing if SSO is enabled
 Medium
EPSS 1.30%
>= 2.0.0, < 2.1.15
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.4
2.1.15
2.2.9
2.3.4
GHSA-6gcg-hp2x-q54h
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
 Medium
EPSS 1.15%
< 2.1.15
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.4
2.1.15
2.2.9
2.3.4
GHSA-6gcg-hp2x-q54h
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
 Medium
EPSS 1.15%
>= 2.3.0, < 2.3.4
2.3.4
GHSA-6gcg-hp2x-q54h
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
 Medium
EPSS 1.15%
>= 2.2.0, < 2.2.9
2.2.9
GHSA-6gcg-hp2x-q54h
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
 Medium
EPSS 1.15%
< 2.1.15
2.1.15
GHSA-96jv-vj39-x4j6
Improper access control allows admin privilege escalation in Argo CD
 High
EPSS 1.34%
>= 2.3.0, < 2.3.2
2.3.2
GHSA-96jv-vj39-x4j6
Improper access control allows admin privilege escalation in Argo CD
 High
EPSS 1.34%
< 2.1.14
2.1.14
GHSA-96jv-vj39-x4j6
Improper access control allows admin privilege escalation in Argo CD
 High
EPSS 1.34%
< 2.1.14
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.2
2.1.14
2.2.8
2.3.2
GHSA-96jv-vj39-x4j6
Improper access control allows admin privilege escalation in Argo CD
 High
EPSS 1.34%
>= 2.2.0, < 2.2.8
2.2.8
GHSA-96jv-vj39-x4j6
Improper access control allows admin privilege escalation in Argo CD
 High
EPSS 1.34%
< 2.1.14
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.2
2.1.14
2.2.8
2.3.2
GO-2022-0358
Path traversal allows leaking out-of-bound files from Argo CD repo-server
 Medium
EPSS 0.96%
< 2.1.11
>= 2.2.0, < 2.2.6
>= 2.3.0-rc1, < 2.3.0
2.1.11
2.2.6
2.3.0
GO-2022-0357
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
 Medium
EPSS 0.90%
< 2.1.11
>= 2.2.0, < 2.2.6
>= 2.3.0-rc1, < 2.3.0
2.1.11
2.2.6
2.3.0
GHSA-63qx-x74g-jcr7
Path traversal and dereference of symlinks in Argo CD
 High
EPSS 2.77%
< 2.1.9
>= 2.2.0, < 2.2.4
2.1.9
2.2.4
GHSA-63qx-x74g-jcr7
Path traversal and dereference of symlinks in Argo CD
 High
EPSS 2.77%
>= 2.2.0, < 2.2.4
2.2.4
GHSA-63qx-x74g-jcr7
Path traversal and dereference of symlinks in Argo CD
 High
EPSS 2.77%
< 2.1.9
2.1.9
GHSA-qq5v-f4c3-395c
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
 Medium
EPSS 0.59%
< 1.7.13
1.7.13
GHSA-qq5v-f4c3-395c
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
 Medium
EPSS 0.59%
>= 1.8.0, < 1.8.6
1.8.6
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor