CVE-2026-45738 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, argo-cd...

GHSA-RG3G-4RW9-GQRP vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

CVE-2026-45738 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

CVE-2026-45737 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GHSA-H98R-WV3H-FR38 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argo-cd, argocd-image-updater...

GHSA-H98R-WV3H-FR38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Summary A user with application write access developer role can set link.argocd.argoproj.io/ annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab's URLs section as elements without URL validation. Using the pipe-separator trick Display Text |...

GHSA-3V3M-WC6V-X4X3 vulnerabilities

Vulnerabilities for packages: argocd-image-updater...

CVE-2026-42880 vulnerabilities

Vulnerabilities for packages: argocd-image-updater...

GHSA-3V3M-WC6V-X4X3 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...

CVE-2026-42880 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...

EUVD-2026-28469

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: kots, wolfictl, trufflehog, flux-source-controller, argo-workflows-fips, argo-workflows, trivy-operator, syft-fips, grype, flux-source-controller-fips, kaniko-fips, scorecard, flux, trivy-operator-fips, terragrunt-fips, cloudbeat-fips, chainctl, k9s-fips,...

EUVD-2026-23126

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...

CVE-2026-6388

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Summary The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 "Unexpected session resumption in crypto/tls". Details See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability. Provider versions starting with v7.15.1 are using go 1.25.8 for buildin...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kuma, falcosidekick-fips, syft-fips, aws-otel-collector-fips, kaniko-fips, sftpgo-plugin-pubsub, kubernetes-csi-external-provisioner, scorecard, envoy-gateway, terraform-provider-google-fips, cass-operator-fips, k6-operator, vault, cri-tools, velero-fips, seaweedfs,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: actions-runner-controller, pulumi-language-dotnet, crossplane-provider-aws-kms, argo-workflows, xeol, crossplane-provider-azure-managedidentity, kyverno-notation-aws, helm, crossplane-provider-aws-dynamodb, atlantis, external-secrets-operator, grafana, skaffold,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: actions-runner-controller, pulumi-language-dotnet, crossplane-provider-aws-kms, argo-workflows, xeol, crossplane-provider-azure-managedidentity, kyverno-notation-aws, helm, crossplane-provider-aws-dynamodb, atlantis, external-secrets-operator, grafana, skaffold,...

GHSA-274V-MGCV-CM8J vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...

GHSA-PCQX-8QWW-7F4V OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources CRs that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged...