github.com/argoproj/argo-cd/v3 (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 3.6.0-rc2 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/argoproj/argo-cd/v3@v3.6.0-rc2 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical EPSS 0.50%	`>= 3.0.0, < 3.3.15`	`3.3.15`
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical EPSS 0.50%	`>= 3.0.0, < 3.3.15` `>= 3.4.0, < 3.4.10` `>= 3.5.0, < 3.5.4` `>= 3.6.0-rc1, < 3.6.0-rc2`	`3.3.15` `3.4.10` `3.5.4` `3.6.0-rc2`
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical EPSS 0.50%	`>= 3.6.0-rc1, < 3.6.0-rc2`	`3.6.0-rc2`
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical EPSS 0.50%	`>= 3.5.0, < 3.5.4`	`3.5.4`
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical EPSS 0.50%	`>= 3.4.0, < 3.4.10`	`3.4.10`
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High EPSS 1.87%	`>= 3.4.0, < 3.4.10`	`3.4.10`
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High EPSS 1.87%	`>= 3.0.0, < 3.3.15`	`3.3.15`
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High EPSS 1.87%	`>= 3.5.0, < 3.5.4`	`3.5.4`
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High EPSS 1.87%	`>= 3.6.0-rc1, < 3.6.0-rc2`	`3.6.0-rc2`
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High EPSS 1.87%	`>= 3.0.0, < 3.3.15` `>= 3.4.0, < 3.4.10` `>= 3.5.0, < 3.5.4` `>= 3.6.0-rc1, < 3.6.0-rc2`	`3.3.15` `3.4.10` `3.5.4` `3.6.0-rc2`
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High EPSS 0.61%	`< 3.2.12` `>= 3.3.0-rc1, < 3.3.10` `>= 3.4.0-rc1, < 3.4.2`	`3.2.12` `3.3.10` `3.4.2`
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High EPSS 0.61%	`>= 3.4.0-rc1, < 3.4.2`	`3.4.2`
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High EPSS 0.61%	`>= 3.3.0-rc1, < 3.3.10`	`3.3.10`
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High EPSS 0.61%	`< 3.2.12`	`3.2.12`
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium EPSS 0.52%	`>= 3.4.0-rc1, < 3.4.2`	`3.4.2`
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium EPSS 0.52%	`>= 3.2.0, < 3.2.12` `>= 3.3.0-rc1, < 3.3.10` `>= 3.4.0-rc1, < 3.4.2`	`3.2.12` `3.3.10` `3.4.2`
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium EPSS 0.52%	`>= 3.2.0, < 3.2.12`	`3.2.12`
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium EPSS 0.52%	`>= 3.3.0-rc1, < 3.3.10`	`3.3.10`
GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction	Critical EPSS 0.84%	`>= 3.3.0, < 3.3.9`	`3.3.9`
GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction	Critical EPSS 0.84%	`>= 3.2.0, < 3.2.11`	`3.2.11`
GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction	Critical EPSS 0.84%	`>= 3.2.0, < 3.2.11` `>= 3.3.0, < 3.3.9`	`3.2.11` `3.3.9`
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High EPSS 9.36%	`>= 3.2.0-rc1, < 3.2.0-rc2`	`3.2.0-rc2`
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High EPSS 9.36%	`>= 3.0.0-rc1, < 3.0.19` `>= 3.1.0-rc1, < 3.1.8` `>= 3.2.0-rc1, < 3.2.0-rc2`	`3.0.19` `3.1.8` `3.2.0-rc2`
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High EPSS 9.36%	`>= 3.1.0-rc1, < 3.1.8`	`3.1.8`
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High EPSS 9.36%	`>= 3.0.0-rc1, < 3.0.19`	`3.0.19`
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High EPSS 0.60%	`>= 3.1.0-rc1, < 3.1.8`	`3.1.8`
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High EPSS 0.60%	`>= 3.2.0-rc1, < 3.2.0-rc2`	`3.2.0-rc2`
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High EPSS 0.60%	`>= 3.0.0-rc1, < 3.0.19` `>= 3.1.0-rc1, < 3.1.8` `>= 3.2.0-rc1, < 3.2.0-rc2`	`3.0.19` `3.1.8` `3.2.0-rc2`
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High EPSS 0.60%	`>= 3.0.0-rc1, < 3.0.19`	`3.0.19`
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High EPSS 0.59%	`>= 3.0.0-rc1, < 3.0.19` `>= 3.1.0-rc1, < 3.1.8` `>= 3.2.0-rc1, < 3.2.0-rc2`	`3.0.19` `3.1.8` `3.2.0-rc2`
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High EPSS 0.59%	`>= 3.2.0-rc1, < 3.2.0-rc2`	`3.2.0-rc2`
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High EPSS 0.59%	`>= 3.1.0-rc1, < 3.1.8`	`3.1.8`
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High EPSS 0.59%	`>= 3.0.0-rc1, < 3.0.19`	`3.0.19`
GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server	Medium EPSS 0.48%	`>= 3.1.0-rc1, < 3.1.8`	`3.1.8`
GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server	Medium EPSS 0.48%	`>= 3.2.0-rc1, < 3.2.0-rc2`	`3.2.0-rc2`
GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server	Medium EPSS 0.48%	`>= 3.0.0-rc1, < 3.0.19`	`3.0.19`
GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server	Medium EPSS 0.48%	`>= 3.0.0-rc1, < 3.0.19` `>= 3.1.0-rc1, < 3.1.8` `>= 3.2.0-rc1, < 3.2.0-rc2`	`3.0.19` `3.1.8` `3.2.0-rc2`
GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials	Critical EPSS 5.66%	`< 3.0.14` `>= 3.1.0-rc1, < 3.1.2`	`3.0.14` `3.1.2`
GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials	Critical EPSS 5.66%	`>= 3.1.0-rc1, < 3.1.2`	`3.1.2`
GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials	Critical EPSS 5.66%	`< 3.0.14`	`3.0.14`
GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page	Medium EPSS 0.49%	`< 3.0.4`	`3.0.4`
GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page	Medium EPSS 0.49%	`< 3.0.4`	`3.0.4`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor