ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, cluster-autoscaler-fips, longhorn-manager-fips, rancher-system-agent, harvester-fips, eks-distro, azurefile-csi, longhorn-share-manager-fips, longhorn-manager, rke2-runtime-fips, azuredisk-csi, longhorn-share-manager, kubernetes-csi-driver-hostpath,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ratify-fips, helm-exporter, headlamp-fips, rancher-fleet-fips, linkerd2-fips, drone-fips, k8ssandra-client, helm-operator-fips, rancher-helm, kyverno, chartmuseum-fips, gatekeeper, ratify, falcoctl-fips, manifest-tool, kgateway-fips, opentofu, gitlab-operator-fips,...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, azure-container-networking, longhorn-manager-fips, vcluster, harvester-fips, spark-operator-fips, kubernetes, longhorn-share-manager-fips, longhorn-manager, rke2-runtime-fips, longhorn-share-manager, harvester...

GO-2026-5418 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GO-2026-5885 vulnerabilities

Vulnerabilities for packages: ratify-fips, helm-exporter, headlamp-fips, rancher-fleet-fips, k8sgpt, harvester-fips, linkerd2-fips, drone-fips, k8ssandra-client, helm-operator-fips, rancher-helm, kyverno, chartmuseum-fips, gatekeeper, ratify, falcoctl-fips, manifest-tool, kgateway-fips, opentofu,...

GO-2026-5618 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GO-2026-5693 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, flux-fips, gitlab-rails-ce-fips, flux, external-secrets-operator, external-secrets-operator-fips, argo-cd, gitaly, nemo, grafana, gitlab-rails-ce, terragrunt, teleport, grafana-fips, upwind-agent, guac, terragrunt-fips...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: kubewatch, argo-rollouts-fips, kyverno-policy-reporter-fips, argo-rollouts, ory-kratos, argo-events-fips, kyverno-policy-reporter, argo-cd, goreleaser, atlantis, argo-events, kubernetes-event-exporter-fips, kubernetes-event-exporter, ory-kratos-fips, bento,...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: loki-fips, keda, splunk-otel-collector-fips, fluent-bit-plugin-loki, kots, gitea-fips, argo-cd, falcosidekick-fips, atlantis, dapr-fips, loki, gitea, falcosidekick, dapr, mattermost-fips, opentelemetry-collector-contrib-fips, argo-cd-fips, authservice, oauth2-proxy,...

GO-2025-3995 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2024-3002 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2025-3994 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2025-3720 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GO-2025-3934 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: fulcio, timestamp-authority-fips, rekor, grafana-mimir, argo-cd, timestamp-authority, fulcio-fips, prometheus-alertmanager-fips, cortex, cortex-fips, rekor-fips, prometheus-alertmanager...

GO-2025-3996 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2025-3993 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2024-2877 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2026-5025 vulnerabilities

Vulnerabilities for packages: hubble, virt-operator-fips, zot, tenv-fips, commercial-grafana, terraform, crossplane-provider-azure-servicefabric, crossplane-provider-azure-streamanalytics, kubernetes, terraform-provider-acme, etcd, frankenphp-8.3, cilium-envoy-fips, flux, gitea, nemo, hydra,...