Github.Com Argoproj Argo-Cd vulnerabilities

CVE-2022-29165 [CRITICAL] CWE-200 Argo CD will blindly trust JWT claims if anonymous access is enabled Argo CD will blindly trust JWT claims if anonymous access is enabled ### Impact A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In order for this vulnerability to be exploited, [anonymous access](

CVE-2024-31989 [CRITICAL] CWE-327 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache ### Summary By default, the Redis database server is not password-protected. Consequently, an attacker with access to the Redis server can gain read/write access to the data in Redis. The attacker can also modify the "mfst" (manifest) key to cause ArgoCD to execute any deployment, potentially l

CVE-2022-24768 [CRITICAL] CWE-200 Improper access control allows admin privilege escalation in Argo CD Improper access control allows admin privilege escalation in Argo CD ### Impact #### Impacts for versions starting with v1.0.0 All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. To perform the following exploits, an authorized Argo CD user must have push a

CVE-2023-22482 [CRITICAL] CWE-863 JWT audience claim is not verified JWT audience claim is not verified ### Impact All versions of Argo CD starting with v1.8.2 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the

CVE-2020-8828 [HIGH] CWE-1188 Argo CD Insecure default administrative password Argo CD Insecure default administrative password In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere. #

CVE-2023-23947 [CRITICAL] CWE-863 Users with any cluster secret update access may update out-of-bounds cluster secrets Users with any cluster secret update access may update out-of-bounds cluster secrets ### Impact All Argo CD versions starting with v2.3.0-rc1 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlli

CVE-2022-24348 [HIGH] CWE-200 Path traversal and dereference of symlinks in Argo CD Path traversal and dereference of symlinks in Argo CD ### Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory. If an attacker wit

CVE-2022-1025 [HIGH] CWE-1220 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level Argo CD improper access control bug can allow malicious user to escalate privileges to admin level # Impact ## Impacts for versions starting with v1.0.0 All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. To perform the following ex

CVE-2022-31105 [HIGH] CWE-295 Argo CD certificate verification is skipped for connections to OIDC providers Argo CD certificate verification is skipped for connections to OIDC providers ### Impact All versions of Argo CD starting with v0.4.0 are vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OIDC provider. (Note: external OIDC provider support was added in v0.11.0. Before that version, the notes below apply only

CVE-2025-59531 [HIGH] CWE-703 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload ### Summary Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no `webhook.bitbucketserver.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-s

CVE-2020-8827 [HIGH] CWE-307 Improper Restriction of Excessive Authentication Attempts in Argo API Improper Restriction of Excessive Authentication Attempts in Argo API As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence. ### Specific Go Packages Affected github.com/argoproj/argo-cd/util/cache

CVE-2022-31034 [HIGH] CWE-330 Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params ### Impact All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a non-cryptographically-se

CVE-2025-59537 [HIGH] CWE-20 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload ### Summary Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no `webhook.gogs.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a G

CVE-2024-40634 [HIGH] CWE-400 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint ### Summary This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill.

CVE-2024-22424 [HIGH] CWE-352 github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability ### Impact The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16 are vulnerable to a cross-server request forgery (CSRF) attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo CD. A CSRF attack works by tricking an authenticated Argo CD user into loading a web page whic

CVE-2024-21661 [HIGH] CWE-787 Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment ### Summary An attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment.

CVE-2022-24730 [HIGH] CWE-22 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server ### Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A

CVE-2023-50726 [MEDIUM] CWE-269 Users with `create` but not `override` privileges can perform local sync Users with `create` but not `override` privileges can perform local sync ### Impact "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug all

CVE-2018-21034 [MEDIUM] CWE-200 Argo Exposure of Sensitive Information Argo Exposure of Sensitive Information In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.

CVE-2025-23216 [MEDIUM] CWE-200 Argo CD does not scrub secret values from patch errors Argo CD does not scrub secret values from patch errors ### Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to