What’s Vulnerable › Products
argoproj argo-cd vulnerabilities
63 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your argoproj argo-cd version is affected
Latest argoproj argo-cd vulnerabilities
- CVE-2026-113709 — Argo CD: A Kustomize Helm config home can run commands in the repo-server (CVSS 9.9)
- CVE-2026-113708 — Argo CD: A Kustomize remote ref can run commands in the repo-server (CVSS 9.9)
- CVE-2026-113672 — Argo CD: A Jsonnet import can read files from the repo-server (CVSS 9.9)
- CVE-2026-77459 — Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (CVSS 9.9)
- CVE-2026-55797 — Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8)
- CVE-2026-45738 — Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation (CVSS 8.7)
- CVE-2026-45737 — Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (CVSS 6.5)
- CVE-2026-42880 — ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction (CVSS 9.6)
- CVE-2026-43824 — (CVSS 7.7)
- CVE-2025-59538 — Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook (CVSS 7.5)
- CVE-2025-59537 — argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload (CVSS 7.5)
- CVE-2025-59531 — Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload (CVSS 7.5)
- CVE-2025-55191 — Repository Credentials Race Condition Crashes Argo CD Server (CVSS 5.3)
- CVE-2025-55190 — Argo CD: Project API Token Exposes Repository Credentials (CVSS 9.9)
- CVE-2025-47933 — Argo CD allows cross-site scripting on repositories page (CVSS 5.4)
- CVE-2025-23216 — Argo CD does not scrub secret values from patch errors (CVSS 6.8)
- CVE-2024-41666 — The Argo CD web terminal session does not handle the revocation of user permissions properly. (CVSS 6.5)
- CVE-2024-40634 — Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint (CVSS 7.5)
- CVE-2024-37152 — Unauthenticated Access to sensitive settings in Argo CD (CVSS 7.5)
- CVE-2024-36106 — Argo CD allows authenticated users to enumerate clusters by name (CVSS 4.3)
- CVE-2024-31989 — ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache (CVSS 9.0)
- CVE-2024-32476 — Denial of Service via malicious jqPathExpressions in ignoreDifferences (CVSS 6.5)
- CVE-2024-31990 — Argo CD' API server does not enforce project sourceNamespaces (CVSS 6.3)
- CVE-2024-29893 — Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server (CVSS 6.5)
- CVE-2024-21662 — Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow (CVSS 9.1)