CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, aws-efs-csi-driver-fips, spark-operator, aws-efs-csi-driver, nodetaint, ip-masq-agent, prometheus-adapter, aws-ebs-csi-driver...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: temporal-server, envoy-ratelimit, buildkitd, kubevela, k3s, kubernetes-csi-external-resizer, temporal, cri-tools, kine, volume-modifier-for-k8s, docker-compose, metrics-server, kubescape, kubernetes...

U.S. Dept Of Defense: Unauthorized access to Argo dashboard on █████

The Argo deployment on █████ was found to be vulnerable to unauthorized access, allowing manipulation of workflows and sensors. This could lead to compromise of sensitive data. Urgent mitigation is advised...

GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, kubeflow-pipelines, aws-efs-csi-driver...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, scorecard, spark-operator, up, prometheus-blackbox-exporter, buildkitd, aactl, kubevela, terraform-provider-sendgrid, k3d, cortex, dgraph, src, slsa-verifier, kubescape...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, prometheus-adapter-fips, aactl, spark-operator, kiam, terraform-provider-sendgrid-fips, buildkitd, up, vault-csi-provider, falcoctl-fips, kubernetes-csi-livenessprobe, kubeflow, volume-modifier-for-k8s-fips, metrics-server-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, conftest, kubevela, dynamic-localpv-provisioner, flux-helm-controller, kubernetes-csi-livenessprobe, metacontroller, gitness, cue, newrelic-infrastructure-agent, pulumi, fuse-overlayfs-snapshotter, kaf, pulumi-language-yaml, certificate-transparency,...

Path Traversal

github.com/argoproj/argo-cd/v2 is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check in the repo server API that prevents file traversal attacks. This can lead to an attacker leaking values or files from the referenced Helm Chart by using a using a...

CVE-2023-40026

A flaw was found in Argo CD. For any version using Helm, using a specially crafted Helm file could reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart. This issue is possible because the Helm paths were predictable. Mitigation...

CVE-2023-40026

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

Design/Logic Flaw

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026

CVE-2023-40026 describes a path traversal in Argo CD prior to version 2.3 where a specially crafted Helm file could reference external Helm charts handled by the repo-server, allowing leakage of values or files from the referenced charts due to predictable Helm paths. Exploitation requires access...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

PT-2023-27220 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.3 Description: Argo CD is a declarative continuous deployment framework for Kubernetes. The issue allows an attacker to reference external Helm charts handled by the same repo-server to leak values or files from th...