CVE-2025-55190: Argo CD: Project API Token Exposes Repository Credentials

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-04 · updated 2026-10-18
Weakness: CWE-200

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.

Affected products

argoproj argo-cd: from 2.2.0 before 2.13.9; from 2.14.0 before 2.14.16; from 3.0.0 before 3.0.14; from 3.1.0 before 3.1.2 — fixed in 2.13.9, 2.14.16, 3.0.14, 3.1.2

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.13.9, 2.14.16, 3.0.14, 3.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-55190 or the next vulnerability affects your stack