CVE-2026-62185 Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution...

CVE-2026-62185 Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution...

CVE-2026-62185

The CVE-2026-62185 affects the Argo CD Helm Chart prior to 10.0.0, which fails to install network policies by default. As a result, any pod on the cluster can access the repo-server and other Argo APIs, enabling unrestricted network access. This can lead to cluster compromise and remote code exec...

CLEANSTART-2026-KL41807 Security fixes for CVE-2025-47912, CVE-2025-55190, CVE-2025-55191, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-59537, CVE-2025-59538, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-29181, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-35469, CVE-2026-39821, CVE-2026-39883, CVE-2026-41506, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42880, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, CVE-2026-45737, CVE-2026-45738, ghsa-2v5j-vhc3-9cwm, ghsa-2vgg-9h3w-qbr4, ghsa-2xsj-vh29-9cwm, ghsa-37cx-329c-33x3, ghsa-389r-gv7p-r3rp, ghsa-3v3m-wc6v-x4x3, ghsa-3wgm-2mw2-vh5m, ghsa-3xc5-wrhm-f963, ghsa-4x4m-3c2p-qppc, ghsa-6v2p-p543-phr9, ghsa-78h2-9frx-2jm8, ghsa-92cp-5422-2m47, ghsa-93mq-9ffx-83m2, ghsa-crhj-59gh-8x96, ghsa-f6x5-jh6r-wrfv, ghsa-gm2x-2g9h-ccm8, ghsa-gxhx-2686-5h9g, ghsa-h98r-wv3h-fr38, ghsa-hfvc-g4fc-pqhx, ghsa-hj2p-8wj8-pfq4, ghsa-j5w8-q4qc-rx2x, ghsa-jhf3-xxhw-2wpp, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-mh2q-q3fh-2475, ghsa-mh63-6h87-95cp, ghsa-mw99-9chc-xw7r, ghsa-pc3f-x583-g7j2, ghsa-qw64-3x98-g7q2, ghsa-rg3g-4rw9-gqrp applied in versions: 2.13.9-r0, 2.14.20-r0, 3.0.16-r0, 3.0.19-r0, 3.1.4-r0, 3.1.8.-r0, 3.1.9-r4, 3.2.7-r0, 3.2.7-r1, 3.2.7-r2, 3.2.7-r3, 3.2.7-r4

Multiple security vulnerabilities affect the argo-cd package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-57887

Name of the Vulnerable Software and Affected Versions Argo CD Helm Chart versions prior to 10.0.0 Description The software fails to install network policies by default, which allows any pod within the cluster to access the repo-server and other Argo APIs. This unrestricted network access can be...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: grype-fips, commercial-chainloop-backend, prometheus-operator-fips, knative-serving-fips, hubble, azuredisk-csi-fips, etcd, gitlab-workhorse-ce, cerbos-fips, prometheus-fips, kubeflow-katib, azurefile-csi-fips, traefik-fips, authentik, net-kourier-fips,...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: harvester-fips, cluster-autoscaler-fips, harvester, rke2-runtime-fips, longhorn-manager, eks-distro, azuredisk-csi, argo-cd-fips, kubernetes-csi-driver-hostpath, longhorn-manager-fips, longhorn-share-manager, azurefile-csi, longhorn-share-manager-fips,...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: apply-cve-bump, upwind-agent, kubernetes, argo-workflows, traefik, etcd, harbor-fips, istio, zitadel, commercial-expanso-edge, gitsign, traefik-fips, vitess, argo-cd-fips, k3s, omnictl-multiarch-fips, nemo, argo-events-fips, guac, knative-kafka-broker,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kaf, knative-serving-fips, argo-workflows, etcd, minio-fips, prometheus-fips, rancher, external-dns, trivy, fscrypt, traefik-fips, prometheus-operator, k3s, omnictl-multiarch-fips, flux-image-automation-controller, nemo, argo-workflows-fips, opentofu-fips, chisel-fip...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: apply-cve-bump, dagger, grype-fips, kaf, knative-serving-fips, argo-workflows, gptscript, etcd, prometheus-fips, nuclei, prometheus-podman-exporter-fips, rancher, external-dns, trivy, fscrypt, go-discover-fips, traefik-fips, prometheus-operator, k3s,...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: argocd-image-updater, guac, telegraf, istio, prometheus, k3s, containerd, argo-events, gitsign, vitess, terragrunt, mattermost, argo-cd...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: loki, step-kms-plugin, flux-operator, cosign, flux-notification-controller, opentelemetry-collector, kubernetes-dashboard, steampipe, fulcio, gatus, zot, falcoctl, spire-server, crossplane-provider-azure-authorization, mattermost, sops,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-source-controller, snyk-cli, cloud-provider-aws, telegraf, loki, skaffold, trivy-operator, k3s, osv-scanner, kubernetes, fscrypt, helm, trivy, prometheus-operator, opentelemetry-collector, kubernetes-dashboard, gitea, istio, zot, cilium-cli, k9s, rancher-agent,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: loki, opentelemetry-collector, kubernetes-dashboard, gatus, zot, spire-server, mattermost, flux-image-automation-controller, pulumi-language-dotnet, wal-g, gptscript, gomplate, knative-serving, scorecard, melange, kots, guac, opentofu, trivy-operator,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, loki, terraform-provider-acme, step-kms-plugin, flux-operator, cosign, crossplane-provider-keycloak, flux-notification-controller, opentelemetry-collector, kubernetes-dashboard, crossplane-provider-aws-lambda, steampipe,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: loki, step-kms-plugin, opentelemetry-collector, kubernetes-dashboard, zot, spire-server, mattermost, flux-image-automation-controller, pulumi-language-dotnet, buildah, gptscript, gomplate, knative-serving, scorecard, melange, kots, guac, opentofu, trivy-operator,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: snyk-cli, cloud-provider-aws, telegraf, loki, k3s, kubernetes, fscrypt, helm, prometheus-operator, opentelemetry-collector, kubernetes-dashboard, istio, docker-cli-buildx, zot, cilium-cli, podman, rancher-agent, spire-server, mattermost, nerdctl, kine, kyverno, ciliu...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: flux-source-controller, snyk-cli, cloud-provider-aws, telegraf, loki, skaffold, trivy-operator, k3s, osv-scanner, kubernetes, fscrypt, helm, trivy, prometheus-operator, opentelemetry-collector, kubernetes-dashboard, gitea, istio, zot, cilium-cli, k9s, rancher-agent,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: loki, step-kms-plugin, flux-operator, cosign, flux-notification-controller, opentelemetry-collector, kubernetes-dashboard, steampipe, fulcio, gatus, zot, falcoctl, spire-server, crossplane-provider-azure-authorization, mattermost, sops,...

GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...