ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

POC_CVE-2026-42880

CVE-2026-42880 — ArgoCD Secret Exposure via ServerSideDiff A lab environment for reproducing and detecting CVE-2026-42880 , a critical vulnerability in Argo CD where the ServerSideDiff gRPC handler exposes Kubernetes Secret data to read-only users. Vulnerability Overview Field| Details ---|--- CV...

CVE-2024-31989

CVE-2024-31989 CVE-Exploit for Argo CD This repository contains an exploit for CVE-2024-31989 that targets a Redis instance without a password in Argo CD. Description Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This exploit leverages a vulnerability in Argo CD where ...

CLEANSTART-2026-LF98611 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the argo-cd package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-QT54254 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the argo-cd package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CVE-2026-121621

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

EUVD-2026-116381

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

CVE-2026-121621 Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

CVE-2026-121621

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

argoproj-labs Argo CD Image Updater command injection vulnerability

The argoproj-labs Argo CD Image Updater contains a command injection vulnerability. This vulnerability arises because the proxy URL for SSH repositories configured in Argo CD Image Updater is passed unvalidated to shell commands, allowing attackers to inject shell metacharacters and execute...

CLEANSTART-2026-UA27501 Security fix for GHSA-3xc5-wrhm-f963 applied in: argo-events 1.6.3-r1, grafana-alloy-fips 1.15.0-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0, grafana-alloy-fips 1.14.2-r1

GHSA-3xc5-wrhm-f963 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EN34682 Security fix for GHSA-m7cr-m3pv-hgrp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

GHSA-m7cr-m3pv-hgrp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RT07102 Security fix for GHSA-crhj-59gh-8x96 applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

GHSA-crhj-59gh-8x96 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ND43339 Security fix for GHSA-gm2x-2g9h-ccm8 applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

GHSA-gm2x-2g9h-ccm8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OQ83396 Security fix for GHSA-jhf3-xxhw-2wpp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

GHSA-jhf3-xxhw-2wpp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PR75868 Security fix for GHSA-389r-gv7p-r3rp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

GHSA-389r-gv7p-r3rp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SG72830 Security fix for GHSA-mh2q-q3fh-2475 applied in: bank-vaults 1.32.1-r1, minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, haproxy-ingress 0.15.4-r0, openbao 2.5.4-r1, argo-cd-fips 3.3.7-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, external-secrets-operator-fips 2.4.1-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2, prometheus 3.10.0-r1

GHSA-mh2q-q3fh-2475 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KJ42355 Security fix for GHSA-pc3f-x583-g7j2 applied in: rabbitmq-cluster-operator 2.19.2-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, dynatrace-operator 1.7.3-r1

GHSA-pc3f-x583-g7j2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LW61717 Security fix for GHSA-vh4v-2xq2-g5cg applied in: argo-cd-fips 3.3.7-r5, argo-cd-fips 3.3.7-r6, rancher-fleet-agent 0.13.16-r1

GHSA-vh4v-2xq2-g5cg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WH73146 Security fix for GHSA-8xwf-rjm4-xvhv applied in: argo-cd-fips 3.3.7-r5, argo-cd-fips 3.3.7-r6, rancher-fleet-agent 0.13.16-r1

GHSA-8xwf-rjm4-xvhv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...