1021 matches found
ArgoCD Project API Token Repository Credentials Exposure
Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...
EUVD-2026-68103
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456
argocd-mcp version 0.8.0 (argoproj-labs) has an authentication bypass via its unauthenticated HTTP transport. The server binds to all network interfaces and accepts MCP sessions without requiring caller credentials when the ARGOCD_API_TOKEN environment variable is configured. Any network-reachabl...
POC_CVE-2026-42880
CVE-2026-42880 — Esposizione di Secret in ArgoCD tramite ServerSideDiff Un ambiente di laboratorio per riprodurre e rilevare CVE-2026-42880 , una vulnerabilità critica in Argo CD in cui l'handler gRPC ServerSideDiff espone i dati dei Secret Kubernetes a utenti con soli permessi di sola lettura...
CVE-2024-31989
CVE-2024-31989 Exploit CVE per Argo CD Questo repository contiene un exploit per CVE-2024-31989 che prende di mira un'istanza Redis senza password in Argo CD. Descrizione Argo CD è uno strumento dichiarativo di continuous delivery GitOps per Kubernetes. Questo exploit sfrutta una vulnerabilità in...
BIT-ARGO-CD-2025-55191 Repository Credentials Race Condition Crashes Argo CD Server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0, 3.1.0 through 3.1.7, and 3.0.0 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: gitlab-operator, helm-set-status, k9s, kube-arangodb-fips, envoy-gateway-fips, cluster-api-helm-controller-fips, crossplane, kubescape-operator-fips, kyverno-notation-aws, tigera-operator, opentofu, kubescape-operator, xeol, kube-mgmt-fips, helm-exporter, oras, trivy...
GO-2025-3547 vulnerabilities
Vulnerabilities for packages: rancher-system-agent, rke2-runtime-fips, longhorn-share-manager-fips, argo-cd-fips, harvester, kubernetes-csi-driver-hostpath, longhorn-share-manager, azurefile-csi, azurefile-csi-fips, azuredisk-csi, cluster-autoscaler-fips, longhorn-manager-fips, eks-distro,...
GO-2025-3521 vulnerabilities
Vulnerabilities for packages: longhorn-share-manager-fips, harvester-fips, spark-operator-fips, argo-cd-fips, harvester, longhorn-share-manager, vcluster, longhorn-manager-fips, rke2-runtime-fips, kubernetes, azure-container-networking, longhorn-manager...
GO-2026-5418 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, argo-cd...
GO-2026-5885 vulnerabilities
Vulnerabilities for packages: gitlab-operator, helm-set-status, k9s, kube-arangodb-fips, envoy-gateway-fips, cluster-api-helm-controller-fips, crossplane, kubescape-operator-fips, kyverno-notation-aws, tigera-operator, opentofu, kubescape-operator, xeol, kube-mgmt-fips, helm-exporter, oras, trivy...
GO-2026-5693 vulnerabilities
Vulnerabilities for packages: guac, terragrunt, nemo, upwind-agent, external-secrets-operator, argo-cd-fips, external-secrets-operator-fips, flux-fips, argo-cd, flux, terragrunt-fips, grafana-fips, gitaly, grafana, gitlab-rails-ce-fips, teleport, gitlab-rails-ce...
GO-2026-5618 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, argo-cd...
GO-2025-3995 vulnerabilities
Vulnerabilities for packages: argo-cd...
GO-2024-3002 vulnerabilities
Vulnerabilities for packages: argo-cd...
GO-2025-3994 vulnerabilities
Vulnerabilities for packages: argo-cd...
GO-2025-3540 vulnerabilities
Vulnerabilities for packages: atlantis, argo-cd-fips, gitea, traefik-fips, dapr, falcosidekick-fips, splunk-otel-collector, dapr-fips, splunk-otel-collector-fips, oauth2-proxy, keda, falcosidekick, opentelemetry-collector-contrib-fips, fluent-bit-plugin-loki, juicefs, kots, mattermost-fips,...
GO-2026-5410 vulnerabilities
Vulnerabilities for packages: atlantis, bento-fips, argo-cd-fips, peerdb-flow, kubewatch, kubernetes-event-exporter-fips, argo-rollouts-fips, argo-events, ory-kratos, kyverno-policy-reporter, argo-events-fips, goreleaser, argo-rollouts, kyverno-policy-reporter-fips, kubernetes-event-exporter,...