1769 matches found
PT-2025-5629 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.13.4 Argo CD versions prior to 2.12.10 Argo CD versions prior to 2.11.13 Description: A vulnerability was discovered that exposes secret values in error messages and the diff view when an invalid Kubernetes Secret...
Argo CD 安全漏洞
Argo CD is an Argo open source declarative GitOps continuous delivery tool for Kubernetes. A security vulnerability exists in Argo CD that stems from exposing secret values in error messages and diff views when synchronizing invalid Kubernetes Secret resources from a repository...
GHSA-29QP-CRVH-W22M vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-rds, velero, tflint, crossplane-provider-aws-s3, crossplane-provider-aws-cloudformation, sftpgo, crossplane-provider-aws-sns, velero-plugin-for-microsoft-azure, crossplane-provider-aws-sqs, sftpgo-plugin-aut...
GHSA-29QP-CRVH-W22M vulnerabilities
Vulnerabilities for packages: grafana-fips, kafka-proxy, crossplane-provider-aws-route53, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-s3, crossplane-provider-aws-sqs, openbao, argo-rollouts, velero-fips, crossplane-provider-aws-firehose, velero-plugin-for-aws-fips,...
CVE-2024-13484 Openshift-gitops-operator-container: namespace isolation break
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the...
Argo CD 安全漏洞
Argo CD is an Argo open source declarative GitOps continuous delivery tool for Kubernetes. A security vulnerability exists in Argo CD that stems from the fact that the openshift.io/cluster-monitoring tag is automatically applied to all namespaces where ArgoCD CR instances are deployed, allowing t...
GHSA-CWPG-QGC6-JXVQ vulnerabilities
Vulnerabilities for packages: newrelic-fluent-bit-output, argo-workflows, kubeflow-katib...
CVE-2025-21614 vulnerabilities
Vulnerabilities for packages: kots, crossplane, goreleaser, argo-events, k8sgpt, chainctl, grafana-alloy, kyverno, nemo, flux, argo-workflows, apko, k9s, melange, osv-scanner, tfsec, trivy, kaniko, bom, timoni, kyverno-fips, src-fingerprint, kaniko-fips, gitea, kubevela, pulumi-language-java,...
GHSA-V725-9546-7Q7M vulnerabilities
Vulnerabilities for packages: kots, crossplane, goreleaser, argo-events, k8sgpt, chainctl, grafana-alloy, kyverno, nemo, flux, argo-workflows, apko, k9s, melange, osv-scanner, tfsec, trivy, kaniko, bom, timoni, kyverno-fips, src-fingerprint, kaniko-fips, gitea, kubevela, pulumi-language-java,...
Sensitive Information Exposure
github.com/argoproj/argo-workflows/v3 is vulnerable to a Sensitive Information Exposure. The vulnerability is due to the absence of proper authentication checks in the GET Workflow endpoint when retrieving Archived Workflows. Specifically, when using --auth-mode=client, fake or spoofed tokens can...
SUSE CVE-2024-53862
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...
GHSA-RHX6-C78J-4Q9W vulnerabilities
Vulnerabilities for packages: argo-workflows, tileserver-gl-fips, thingsboard, sqlpad, grafana-image-renderer, tileserver-gl, arangodb, kubeflow-pipelines, kubeflow-centraldashboard...
GHSA-H36C-M3RF-34H9 vulnerabilities
Vulnerabilities for packages: argo-workflows, argo-workflows-fips...
GHSA-H36C-M3RF-34H9 vulnerabilities
Vulnerabilities for packages: argo-workflows...
GHSA-H36C-M3RF-34H9 Access to Archived Argo Workflows with Fake Token in `client` mode
Summary When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name When using --auth-mode=sso, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint:...
CVE-2024-53862
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...
GO-2024-3303 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
Argo Workflows Allows Access to Archived Workflows with Fake Token in client mode in github.com/argoproj/argo-workflows...
CVE-2024-53862
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...