What’s Vulnerable › Vulnerabilities

CVE-2022-41354

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-27 · updated 2026-07-09
• Weakness: CWE-203

Description

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

Affected products

• Linuxfoundation Argo-Cd: from 0.5.0 before 2.4.28; from 2.5.0 before 2.5.16; from 2.6.0 before 2.6.7 — fixed in 2.4.28, 2.5.16, 2.6.7

How to fix

Upgrade to a fixed version: Linuxfoundation Argo-Cd 2.4.28, 2.5.16, 2.6.7. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq
• https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq
• https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md

Get alerted when CVE-2022-41354 or the next vulnerability affects your stack