Argoproj Argo Project Argo CD any version

Argo CD will blindly trust JWT claims if anonymous access is enabled

Argo CD: Project API Token Exposes Repository Credentials

Improper access control allows admin privilege escalation in Argo CD

Cluster secret might leak in cluster details page in Argo CD

Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

Argo CD's certificate verification is skipped for connections to OIDC providers

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

External URLs for Deployments can include javascript in argo-cd

JWT audience claim is not verified

Cross-site scripting on application summary component in argo-cd

Argo CD allows cross-site scripting on repositories page

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

Insecure entropy in argo-cd

Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

Unauthenticated Access to sensitive settings in Argo CD

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.

As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.

An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.

Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

Argo CD web terminal session doesn't expire

Path traversal allows leaking out-of-bound files from Argo CD repo-server

Argo CD does not scrub secret values from patch errors

Denial of Service to Argo CD repo-server

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.

Denial of Service via malicious jqPathExpressions in ignoreDifferences

Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

Argo CD vulnerable to Uncontrolled Memory Consumption