Go Package Vulnerabilities
Vulnerabilities associated with github.com/argoproj/argo-cd/v3.
Packages
Clear package- github.com/mattermost/mattermost/server/v8199 vulnerabilities
- github.com/mattermost/mattermost-server178 vulnerabilities
- code.gitea.io/gitea94 vulnerabilities
- gogs.io/gogs76 vulnerabilities
- github.com/usememos/memos74 vulnerabilities
- github.com/grafana/grafana61 vulnerabilities
- github.com/rancher/rancher61 vulnerabilities
- github.com/siyuan-note/siyuan/kernel58 vulnerabilities
- github.com/hashicorp/vault55 vulnerabilities
- github.com/traefik/traefik/v253 vulnerabilities
- github.com/traefik/traefik/v352 vulnerabilities
- github.com/mattermost/mattermost-server/v647 vulnerabilities
- github.com/filebrowser/filebrowser/v243 vulnerabilities
- k8s.io/kubernetes43 vulnerabilities
- github.com/zitadel/zitadel41 vulnerabilities
- github.com/argoproj/argo-cd/v237 vulnerabilities
- github.com/cilium/cilium37 vulnerabilities
- github.com/docker/docker36 vulnerabilities
- github.com/answerdev/answer34 vulnerabilities
- github.com/argoproj/argo-cd34 vulnerabilities
- github.com/hashicorp/nomad34 vulnerabilities
- code.vikunja.io/api33 vulnerabilities
- github.com/hashicorp/consul32 vulnerabilities
- github.com/openbao/openbao29 vulnerabilities
- github.com/traefik/traefik29 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-45737MEDIUM | Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versi… | CVSS6.3v3.1 | EPSS0.359% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-45738HIGH | Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalationArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. … CWE-79Jul 15, 2026 | CVSS7.3v3.1 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42880CRITICAL | ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9. | CVSS9.6v3.1 | EPSS0.506% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-59538HIGH | Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an i… | CVSS7.5v3.1 | EPSS8.34% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-59537HIGH | argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payloadArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].re… | CVSS7.5v3.1 | EPSS0.563% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-59531HIGH | Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unau… CWE-703Oct 1, 2025 | CVSS7.5v3.1 | EPSS0.549% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-55191MEDIUM | Repository Credentials Race Condition Crashes Argo CD ServerArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repos… CWE-362Sep 30, 2025 | CVSS6.5v3.1 | EPSS0.441% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-55190CRITICAL | Argo CD: Project API Token Exposes Repository CredentialsArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-… | CVSS10.0v3.1 | EPSS4.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-47933CRITICAL | Argo CD allows cross-site scripting on repositories pageArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4. CWE-79May 29, 2025 | CVSS9.1v3.1 | EPSS0.426% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |