CVE-2025-55190

CRITICALNuclei

Argo CD: Project API Token Exposes Repository Credentials

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-55190 has a selected CVSS score of 10.0 (critical); EIP currently links 1 Nuclei template.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 18, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 5, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

argo-cd

Browse argoproj / argo-cd
CVE List, VulnCheck>= 2.13.0, < 2.13.9affected
>= 2.14.0, < 2.14.16affected
>= 3.0.0, < 3.0.14affected
>= 3.1.0-rc1, < 3.1.2affected

github.com/argoproj/argo-cd/v2

Browse Go / github.com/argoproj/argo-cd/v2
GitHub Advisory2.13.0 to < 2.13.9 · Fixed in 2.13.9affected
2.14.0 to < 2.14.16 · Fixed in 2.14.16affected

github.com/argoproj/argo-cd/v3

Browse Go / github.com/argoproj/argo-cd/v3
GitHub AdvisoryBefore 3.0.14 · Fixed in 3.0.14affected
3.1.0-rc1 to < 3.1.2 · Fixed in 3.1.2affected

Nuclei templates

1
ProjectDiscoveryCRITICALArgoCD Project API Token Repository Credentials ExposureCVSS 9.9

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability affects versions v2.2.0-rc1 and later, including 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12, and 3.1.0-rc1 through 3.1.1. Any token with project get permissions is vulnerable, including global permissions. Note: This template requires valid ArgoCD credentials (username/password) to test the vulnerability.

Impact

Authenticated attackers with project-level API tokens can retrieve sensitive repository credentials including usernames and passwords without requiring explicit secret access permissions.

Remediation

Upgrade ArgoCD to version 2.13.9, 2.14.16, 3.0.13, 3.1.2, or later depending on your version branch that properly restricts repository credential access.

WeaknessesCWE-200
Authorsnukunga[seunghyeonJeon]
Template tagscvecve2025argocdcredentialsexposuregitopskubernetesvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Shodan: http.title:"argo cd"
https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff https://nvd.nist.gov/vuln/detail/CVE-2025-55190 https://github.com/argoproj/argo-cd/commit/e8f86101f5378662ae6151ce5c3a76e9141900e8

Source: ProjectDiscovery

References

4