ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

GO-2026-6505 vulnerabilities

Vulnerabilities for packages: prometheus-operator-fips, cloudprober-fips, backup-restore-operator-fips, dbmate, percona-server-mongodb-operator, cortex-geomys-fips, cert-manager-google-cas-issuer-fips, aactl, knative-net-istio-fips, opensearch-k8s-operator-fips, apm-server-fips, cosign,...

POC_CVE-2026-42880

CVE-2026-42880 — ArgoCD Secret Exposure via ServerSideDiff A lab environment for reproducing and detecting CVE-2026-42880 , a critical vulnerability in Argo CD where the ServerSideDiff gRPC handler exposes Kubernetes Secret data to read-only users. Vulnerability Overview Field| Details ---|--- CV...

CVE-2024-31989

CVE-2024-31989 Exploit de CVE para Argo CD Este repositorio contiene un exploit para CVE-2024-31989 que apunta a una instancia de Redis sin contraseña en Argo CD. Descripción Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Este exploit aprovecha una vulnerabilid...

CLEANSTART-2026-GJ17760 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the argo-cd package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-TD63490 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the argo-cd package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-SC24710 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the argo-cd package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-ET86515 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

GHSA-H7VF-4X9W-H99V vulnerabilities

Vulnerabilities for packages: tigera-operator, kube-arangodb-fips, maru, ocm-cli, cluster-api-helm-controller-fips, k8sgpt, ocm-kubernetes-controller, opentofu, flux-helm-controller, kyverno-notation-aws-fips, ocm-cli-fips, tigera-operator-fips, chaos-mesh-fips, consul-k8s, helm-exporter,...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: tigera-operator, kube-arangodb-fips, maru, ocm-cli, cluster-api-helm-controller-fips, k8sgpt, ocm-kubernetes-controller, opentofu, flux-helm-controller, kyverno-notation-aws-fips, ocm-cli-fips, tigera-operator-fips, chaos-mesh-fips, consul-k8s, helm-exporter,...

CLEANSTART-2026-AU20661 Security fix for ghsa-mh63-6h87-95cp applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0, argo-events 1.9.7-r1, argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, boring-registry-fips 0.15.5-r2, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, cortex-fips 0, cosign 2.4.3-r0, cosign 2.5.3-r0, external-dns-fips 0.16.1-r0, falcoctl 0.11.0-r0, harbor-fips 2.10.3-r0, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, kyverno-fips 1.12.7-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4, minio-operator 6.0.4-r5, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, openbao-fips 2.1.1-r9, opentofu-fips 1.9.4-r0, step-cli 0.27.5-r0, tempo-fips 2.7.2-r0, velero-fips 1.14.1-r1, velero-fips 1.15.2-r0

ghsa-mh63-6h87-95cp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ES01541 Security fix for CVE-2025-55190 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

CVE-2025-55190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WW74873 Security fix for CVE-2025-55191 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

CVE-2025-55191 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KN43906 Security fix for CVE-2025-59538 applied in: argo-cd 3.1.8.-r0, argo-cd-fips 3.1.8.-r0

CVE-2025-59538 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZP55576 Security fix for CVE-2025-59537 applied in: argo-cd 3.1.8.-r0, argo-cd-fips 3.1.8.-r0

CVE-2025-59537 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NZ83550 Security fix for CVE-2025-58186 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0

CVE-2025-58186 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZM30619 Security fix for CVE-2025-58185 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0

CVE-2025-58185 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ31309 Security fix for CVE-2026-25934 applied in: argo-cd 3.0.23-r0, argo-cd-fips 3.0.22-r1, argo-cd-fips 3.1.11-r0, argo-cd-fips 3.1.12-r1, argo-cd-fips 3.2.5-r0, argo-cd-fips 3.2.7-r0, argo-workflows 3.6.17-r0, argo-workflows 3.6.18-r0, argo-workflows 3.7.7-r0, argo-workflows 3.7.8-r0, argo-workflows 3.7.9-r0, argo-workflows-fips 3.6.16-r0, argo-workflows-fips 3.6.17-r1, argo-workflows-fips 3.6.18-r0, argo-workflows-fips 3.7.9-r0, argo-workflows-fips 3.7.9-r1, external-secrets 0.20.4-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 0.20.4-r2, flux-image-automation-controller-fips 4.0.1-r0, gptscript 0.9.8-r0, gptscript 0.9.9-r0, grafana-alloy 1.13.1-r0, grafana-alloy 1.13.2-r0, kubescape 3.0.47-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 1.16.0-r0, syft 1.39.0-r0, timoni 0.25.2-r0

CVE-2026-25934 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JX65599 Security fix for CVE-2025-5187 applied in: argo-cd 3.1.12-r0, local-static-provisioner 2.8.0-r2

CVE-2025-5187 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HE47180 Security fix for CVE-2025-4563 applied in: argo-cd 3.1.12-r0

Security vulnerability affects the argo-cd package. This issue is resolved in later releases. See references for vulnerability details...