CVE-2021-23135: Argo CD leaked secret data into error messages and logs on invalid edits via UI

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-12 · updated 2026-06-17
Weakness: CWE-497

Description

Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.

Affected products

argoproj argo-cd: from 1.7.0 before 1.7.14; from 1.8.0 before 1.8.7 — fixed in 1.7.14, 1.8.7

How to fix

Upgrade to a fixed version: argoproj argo-cd 1.7.14, 1.8.7. Check the vendor advisory for mitigations.

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894
https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894

Get alerted when CVE-2021-23135 or the next vulnerability affects your stack