Argoproj Argo Project Argo CD any version

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.

The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Repository Credentials Race Condition Crashes Argo CD Server

Users with `create` but not `override` privileges can perform local sync in argo-cd

Argo CD' API server does not enforce project sourceNamespaces

An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.

Cross-site Scripting for Argo CD single sign on users

Argo CD leaked secret data into error messages and logs on invalid edits via UI

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Cross-site Scripting (XSS)

Argo CD login screen allows message spoofing if SSO is enabled

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Argo CD allows authenticated users to enumerate clusters by name