CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, gomplate, terragrunt, syft-fips, pulumi-language-yaml, trivy-operator, terragrunt-fips, chainloop-cli-fips, nuclei, gitsign, syft, argo-workflows-fips, src-fingerprint-fips, nemo, gitlab-runner, kubescape-server, cerbos, flux, grype, cg,...

PT-2026-37356

Name of the Vulnerable Software and Affected Versions Argo CD versions 3.2.0 through 3.2.10 Argo CD versions 3.3.0 through 3.3.8 Description A missing authorization and data-masking gap exists in the '/application.ApplicationService/ServerSideDiff' endpoint. This allows an attacker with read-only...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the ServerSideDiff process. An attacker can access sensitive Kubernetes Secret data in cleartext by leveraging this process with appropriate permissions. Remediati...

CVE-2026-43824

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

CVE-2026-43824

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

CVE-2026-43824

Argo CD vulnerable via ServerSideDiff: versions 3.2.0–3.2.10 and 3.3.0–3.3.8 expose cleartext Kubernetes Secret data. Root cause is the ServerSideDiff endpoint returning raw Secret data when IncludeMutationWebhook is enabled, effectively leaking sensitive information in responses. Upstream fixes ...

CVE-2026-43824

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

CVE-2026-43824

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

EUVD-2026-26726

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

CVE-2026-43824

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data...

Argo CD 安全漏洞

Argo CD is an open-source tool developed by Argo for Kubernetes, designed for declarative GitOps continuous delivery. There were security vulnerabilities in versions of Argo CD between 3.2.0 and 3.2.11, as well as between 3.3.0 and 3.3.9. These vulnerabilities stemmed from ServerSideDiff allowing...

PT-2026-36558

Name of the Vulnerable Software and Affected Versions Argo CD versions 3.2.0 through 3.2.10 Argo CD versions 3.3.0 through 3.3.8 Description The 'ServerSideDiff' endpoint allows the disclosure of cleartext Kubernetes Secret data. This occurs when the IncludeMutationWebhook variable is set to true...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: argo-workflows, k9s, external-secrets-operator, kaniko, kubevela, kubescape, flux-source-controller, steampipe, gitsign, gitaly, kyverno, bom, osv-scanner, witness, apko, crossplane, act, argo-cd, trivy, rancher-fleet, flux, grafana-alloy, trufflehog, wolfictl, nucle...

CLEANSTART-2026-BH97849 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the argo-cd package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-6388

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...

CVE-2026-6388

A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...

GHSA-GPX4-37G2-C8PV vulnerabilities

Vulnerabilities for packages: argo-cd-fips, argo-cd...

CVE-2025-59538 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, argo-cd...

GHSA-F9GQ-PRRC-HRHC vulnerabilities

Vulnerabilities for packages: argo-cd-fips, argo-cd...

CVE-2025-59537 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, argo-cd...