What’s Vulnerable › Vulnerabilities

CVE-2025-23216: Argo CD does not scrub secret values from patch errors

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-30 · updated 2026-06-17
• Weakness: CWE-200

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.

Affected products

• argoproj argo-cd: before 2.11.13; from 2.12.0 before 2.12.10; from 2.13.0 before 2.13.4 — fixed in 2.11.13, 2.12.10, 2.13.4

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.11.13, 2.12.10, 2.13.4. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v
• https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca

Get alerted when CVE-2025-23216 or the next vulnerability affects your stack