Vulnerabilities in argoproj

67 results
Vexday analysis

Com 62 CVEs catalogadas e 14 classificadas como críticas, o ecossistema argoproj apresenta uma superfície de ataque que merece atenção contínua, especialmente em ambientes de orquestração GitOps onde os componentes tendem a operar com privilégios elevados. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, e nenhuma CVE consta atualmente como explorada ativamente, o que reduz a urgência imediata, mas não elimina o risco. O tipo de falha mais recorrente é CWE-200 (exposição de informações sensíveis), padrão que pode facilitar movimentação lateral ou reconhecimento em pipelines de CI/CD. A CVE mais perigosa no momento é CVE-2025-55190, com EPSS de 0,0452, e a presença de 2 CVEs com PoC pública combinada às 8 vulnerabilidades surgidas nos últimos 90 dias indica um ritmo de descoberta que demanda monitoramento ativo e ciclos de patching frequentes.

CVE-2023-50726MEDIUMUsers with `create` but not `override` privileges can perform local sync in argo-cdEPSS 0.5%CVE-2026-42297HIGHArgo Workflows Is Missing Authorization in Sync ConfigMap ProviderEPSS 0.5%CVE-2026-42880CRITICALArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionEPSS 0.5%CVE-2023-40026MEDIUMPath traversal allows leaking out-of-bound Helm charts from Argo CD repo-serverEPSS 0.5%CVE-2023-40025MEDIUMArgo CD web terminal session doesn't expireEPSS 0.5%CVE-2025-23216MEDIUMArgo CD does not scrub secret values from patch errorsEPSS 0.5%CVE-2024-31990MEDIUMArgo CD' API server does not enforce project sourceNamespacesEPSS 0.4%CVE-2025-55191MEDIUMRepository Credentials Race Condition Crashes Argo CD ServerEPSS 0.4%CVE-2025-62157HIGHArgo Workflows exposes artifact repository credentials in workflow-controller logsEPSS 0.4%CVE-2025-47933CRITICALArgo CD allows cross-site scripting on repositories pageEPSS 0.4%CVE-2026-42296HIGHArgo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/SecureEPSS 0.4%CVE-2026-31892HIGHWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeEPSS 0.4%CVE-2024-36106MEDIUMArgo CD allows authenticated users to enumerate clusters by nameEPSS 0.4%CVE-2026-45738HIGHArgo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalationEPSS 0.4%CVE-2024-22424HIGHCross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cdEPSS 0.4%CVE-2026-40886HIGHArgo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controllerEPSS 0.4%CVE-2026-42183LOWArgo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)EPSS 0.4%CVE-2026-54526HIGHArgo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencingEPSS 0.4%CVE-2024-47827MEDIUMArgo Workflows Controller: Denial of Service via malicious daemon WorkflowsEPSS 0.4%CVE-2026-45737MEDIUMArgo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsEPSS 0.4%