Argoproj

argoproj

73 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (73)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-3557 2Argoproj Redhat 2Argo Cd Openshift Gitops Jun 17, 2026 Feb 16, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster i...Show more A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.Show less
CVE-2022-24348 1Argoproj 1Argo Cd Jun 17, 2026 Feb 4, 2022 N/A· v4 7.7 HIGH· v3 4.0 MEDIUM· v2 Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a...Show more Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.Show less
CVE-2021-37914 2Argo Workflows Project Argoproj 2Argo Workflows Argo Workflows Jun 17, 2026 Aug 3, 2021 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression tem...Show more In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.Show less
CVE-2021-23135 1Argoproj 1Argo Cd Jun 17, 2026 May 12, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior...Show more Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.Show less
CVE-2021-26924 1Argoproj 1Argo Cd Jun 17, 2026 Mar 15, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.
CVE-2021-26923 1Argoproj 1Argo Cd Jun 17, 2026 Mar 15, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.
CVE-2021-23347 1Argoproj 1Argo Cd Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message...Show more The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.Show less
CVE-2021-26921 1Argoproj 1Argo Cd Jun 17, 2026 Feb 9, 2021 N/A· v4 6.5 MEDIUM· v3 5.0 MEDIUM· v2 In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
CVE-2018-21034 1Argoproj 1Argo Cd Nov 21, 2024 Apr 9, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
CVE-2020-8828 1Argoproj 1Argo Cd Jun 17, 2026 Apr 8, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicio...Show more As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.Show less
CVE-2020-8827 1Argoproj 1Argo Cd Jun 17, 2026 Apr 8, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts witho...Show more As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.Show less
CVE-2020-8826 1Argoproj 1Argo Cd Jun 17, 2026 Apr 8, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
CVE-2020-11576 1Argoproj 1Argo Cd Jun 17, 2026 Apr 8, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing...Show more Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.Show less

Previous 1 2 34