Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.1 security update

An update is now available for Red Hat OpenShift GitOps v1.15.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, memcached-exporter, vertical-pod-autoscaler, supercronic, ferretdb, newrelic-fluent-bit-output, vt-cli, dockerize, goreleaser, k3d, controller-gen, prometheus-alertmanager, nri-mysql, yq, k8sgpt, nri-couchbase, stakater-reloader,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, kiali, kots, goreleaser, k3d, splunk-otel-collector, weaviate, aactl, cosign, ko, harbor-registry, wolfictl, flyte, steampipe, step-issuer, gatus, terragrunt, hydra, istio, tkn, gomplate, rook, timestamp-authority, sops,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: openbao, splunk-otel-collector, dagger, flux-kustomize-controller-fips, spire-server, sftpgo-plugin-kms, vault, buildah, flyte, kyverno-policy-reporter, kyverno-fips, istio-pilot-agent, openbao-fips, argocd-image-updater, grafana-alloy, rekor, step, distribution,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, kiali, kots, goreleaser, k3d, splunk-otel-collector, weaviate, aactl, cosign, ko, harbor-registry, wolfictl, flyte, steampipe, step-issuer, gatus, terragrunt, hydra, istio, tkn, gomplate, rook, timestamp-authority, sops,...

GHSA-JGFP-53C3-624W vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, argo-cd-fips, argocd-image-updater-fips, azuredisk-csi-fips, local-static-provisioner, calico, rancher-webhook, aws-efs-csi-driver-fips, kubernetes, yunikorn-k8shim-fips, argocd-image-updater, cluster-autoscaler-fips, argo-rollouts-fip...

CVE-2025-0426 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, argo-cd-fips, argocd-image-updater-fips, azuredisk-csi-fips, local-static-provisioner, calico, rancher-webhook, aws-efs-csi-driver-fips, kubernetes, yunikorn-k8shim-fips, argocd-image-updater, cluster-autoscaler-fips, argo-rollouts-fip...

SUSE CVE-2025-23216

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2022-24768

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5...

GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd

Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd...

GO-2025-3437 Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine

Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Sensitive Information Disclosure

github.com/argoproj/argo-cd is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of invalid Kubernetes Secret resources, allowing secret values to be exposed in error messages and the diff view. An attacker with write access to the repository can commit...

Secret Exposure

github.com/argoproj/gitops-engine is vulnerable to Secret Exposure. The vulnerability is due to improper handling of invalid Kubernetes Secret resources, which exposes secret values in error messages and the diff view during synchronization, allows an attacker with write access to the repository ...

BIT-ARGO-CD-2025-23216 Argo CD does not scrub secret values from patch errors

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2025-23216

A vulnerability was found in Argo CD where secret values can be exposed in error messages when an invalid Kubernetes Secret resource is synced from a repository. An attacker must have write access to the repository and any user with read access can view the exposed data. Mitigation Mitigation for...

Argo CD does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...

GHSA-47G2-QMH2-749V vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...

GHSA-47G2-QMH2-749V Argo CD does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...

GHSA-47G2-QMH2-749V vulnerabilities

Vulnerabilities for packages: argocd-image-updater...

Argo CD GitOps Engine does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...