ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

CVE-2024-31989

CVE-2024-31989 Exploit de CVE para Argo CD Este repositorio contiene un exploit para CVE-2024-31989 que apunta a una instancia de Redis sin contraseña en Argo CD. Descripción Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Este exploit aprovecha una vulnerabilid...

POC_CVE-2026-42880

CVE-2026-42880 — Exposición de Secretos de ArgoCD mediante ServerSideDiff Un entorno de laboratorio para reproducir y detectar CVE-2026-42880 , una vulnerabilidad crítica en Argo CD donde el manejador gRPC ServerSideDiff expone datos de Secretos de Kubernetes a usuarios de solo lectura. Resumen d...

CLEANSTART-2026-OO93790 Security fixes in argo-cd 3.4.6-r0

Package argo-cd version 3.4.6-r0 fixes 3 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-41178...

CLEANSTART-2026-OO99794 Security fixes in argo-cd-fips 3.4.7-r1

Package argo-cd-fips version 3.4.7-r1 fixes 13 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-IQ94380 Security fixes in argo-cd 3.4.7-r1

Package argo-cd version 3.4.7-r1 fixes 5 vulnerabilities: CVE-2026-71556, CVE-2026-71557, ghsa-hrxh-6v49-42gf, CVE-2026-50163, CVE-2026-41178...

CLEANSTART-2026-II53972 Security fixes in argo-cd 3.4.6-r1

Package argo-cd version 3.4.6-r1 fixes 3 vulnerabilities: CVE-2026-71557, CVE-2026-71556, CVE-2026-50163...

CLEANSTART-2026-OU97529 Security fixes in argo-cd 3.3.14-r1

Package argo-cd version 3.3.14-r1 fixes 5 vulnerabilities: CVE-2026-71556, CVE-2026-71557, CVE-2026-2303, ghsa-hrxh-6v49-42gf, CVE-2026-50163...

CLEANSTART-2026-LO94255 Security fixes in argo-cd 3.3.14-r3

Package argo-cd version 3.3.14-r3 fixes 2 vulnerabilities: CVE-2026-50163, CVE-2026-41178...

CLEANSTART-2026-NY04600 Security fixes in argo-cd 3.3.14-r2

Package argo-cd version 3.3.14-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-VL72619 Security fixes in argo-cd 3.3.13-r0

Package argo-cd version 3.3.13-r0 fixes 3 vulnerabilities: CVE-2026-50163, CVE-2026-71556, CVE-2026-71557...

CLEANSTART-2026-WY48690 Security fixes in argo-cd 3.4.7-r2

Package argo-cd version 3.4.7-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-VT71030 Security fixes in argo-cd-fips 3.4.7-r2

Package argo-cd-fips version 3.4.7-r2 fixes 12 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CLEANSTART-2026-LR05303 Security fixes in argo-cd-fips 3.4.7-r3

Package argo-cd-fips version 3.4.7-r3 fixes 10 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-EC97009 Security fixes in argo-cd 3.4.5-r2

Package argo-cd version 3.4.5-r2 fixes 3 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-41178...

CLEANSTART-2026-SU87029 Security fixes in argo-cd 3.3.12-r4

Package argo-cd version 3.3.12-r4 fixes 2 vulnerabilities: ghsa-259r-337f-4rfw, CVE-2026-41178...

CVE-2026-82456

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

EUVD-2026-68103

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-82456

argocd-mcp version 0.8.0 (argoproj-labs) has an authentication bypass via its unauthenticated HTTP transport. The server binds to all network interfaces and accepts MCP sessions without requiring caller credentials when the ARGOCD_API_TOKEN environment variable is configured. Any network-reachabl...