ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

GHSA-WPFX-QCH4-Q5J2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-bedrockagent-fips, kepler, crossplane-provider-gcp-beta-networksecurity-fips, crossplane-provider-aws-pipes-fips, opa-fips, pyrra, opensearch-datasource-fips, emqx-exporter-fips, krakend, aws-ebs-csi-driver-fips, gitea-fips, argo-workflows,...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: flux, k6, terragrunt, aactl, continuity, grafana-alloy, headlamp, gitness, prometheus-adapter, juicefs, chartmuseum, argo-workflows, yunikorn-web, opencost, atlantis, zarf, kyverno-policy-reporter, cert-manager-webhook-pdns, argo-cd, kubernetes, spire-server,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: flux, k6, terragrunt, aactl, continuity, grafana-alloy, headlamp, gitness, prometheus-adapter, juicefs, chartmuseum, argo-workflows, yunikorn-web, opencost, atlantis, zarf, kyverno-policy-reporter, cert-manager-webhook-pdns, argo-cd, kubernetes, spire-server,...

CLEANSTART-2026-CF02971 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the argo-cd package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CVE-2026-55797

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

CVE-2026-55797

The Argo CD repo-server is vulnerable to command injection (CWE-78) in versions 2.11.0 through 3.3.15 , 3.4.10 , 3.5.4 , and 3.6.0-rc2 . The root cause is the execution of an SSH ProxyCommand containing a proxy host and port through a shell without neutralizing shell metacharacters. An attacker w...

EUVD-2026-95912

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

GHSA-J6CW-G6P4-7HCH Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...

PT-2026-108985

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.11.0 through 3.3.14 Argo CD versions 3.4.0 through 3.4.9 Argo CD versions 3.5.0 through 3.5.3 Argo CD versions 3.6.0-rc1 and earlier Description The Argo CD repo-server is subject to command injection when cloning, testing, ...

CVE-2025-61560

A race condition vulnerability exists in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 . This flaw allows attackers to bypass rate limiting mechanisms by sending repeated crafted requests, which can be used to facilitate a brute force attack . No specific remediatio...

EUVD-2025-211059

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

PT-2026-107675

Four critical Argo CD vulnerabilities, including AppProject bypass CVE-2026-77459, threaten the repo-server and clusters. Upgrade to v3.5.4 now. ArgoCD Kubernetes GitOps CVE202677459 Kustomize Jsonnet DevSecOps Vulnerability https://t.co/QQRWdUYKFa...

POC_CVE-2026-42880

CVE-2026-42880 — Esposizione di Secret in ArgoCD tramite ServerSideDiff Un ambiente di laboratorio per riprodurre e rilevare CVE-2026-42880 , una vulnerabilità critica in Argo CD in cui l'handler gRPC ServerSideDiff espone i dati dei Secret Kubernetes a utenti con soli permessi di sola lettura...

CVE-2024-31989

CVE-2024-31989 Exploit CVE per Argo CD Questo repository contiene un exploit per CVE-2024-31989 che prende di mira un'istanza Redis senza password in Argo CD. Descrizione Argo CD è uno strumento dichiarativo di continuous delivery GitOps per Kubernetes. Questo exploit sfrutta una vulnerabilità in...