Vulnerabilidades em argoproj

67 resultados
Análise Vexday

Com 62 CVEs catalogadas e 14 classificadas como críticas, o ecossistema argoproj apresenta uma superfície de ataque que merece atenção contínua, especialmente em ambientes de orquestração GitOps onde os componentes tendem a operar com privilégios elevados. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, e nenhuma CVE consta atualmente como explorada ativamente, o que reduz a urgência imediata, mas não elimina o risco. O tipo de falha mais recorrente é CWE-200 (exposição de informações sensíveis), padrão que pode facilitar movimentação lateral ou reconhecimento em pipelines de CI/CD. A CVE mais perigosa no momento é CVE-2025-55190, com EPSS de 0,0452, e a presença de 2 CVEs com PoC pública combinada às 8 vulnerabilidades surgidas nos últimos 90 dias indica um ritmo de descoberta que demanda monitoramento ativo e ciclos de patching frequentes.

CVE-2023-22482CRITICALJWT audience claim is not verifiedEPSS 0.9%CVE-2023-25163MEDIUMArgo CD leaks repository credentials in user-facing error messages and in logsEPSS 0.8%CVE-2024-21662HIGHArgo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache OverflowEPSS 0.8%CVE-2022-31016MEDIUMArgo CD vulnerable to Uncontrolled Memory ConsumptionEPSS 0.8%CVE-2022-31036MEDIUMSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverEPSS 0.8%CVE-2023-22736HIGHargo-cd Controller reconciles apps outside configured namespaces when sharding is enabledEPSS 0.8%CVE-2022-31105HIGHArgo CD's certificate verification is skipped for connections to OIDC providersEPSS 0.8%CVE-2025-32445CRITICALUsers can gain privileged access to the host system and cluster with EventSource and Sensor CREPSS 0.8%CVE-2024-21652CRITICALArgo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data LossEPSS 0.8%CVE-2024-41666MEDIUMThe Argo CD web terminal session does not handle the revocation of user permissions properly.EPSS 0.7%CVE-2023-23947CRITICALArgo CD users with any cluster secret update access may update out-of-bounds cluster secretsEPSS 0.7%CVE-2025-66626HIGHargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksEPSS 0.7%CVE-2024-53862MEDIUMArgo Workflows Allows Access to Archived Workflows with Fake Token in `client` modeEPSS 0.7%CVE-2024-28175CRITICALCross-site scripting on application summary component in argo-cdEPSS 0.7%CVE-2026-28229CRITICALArgo Workflows has unauthorized access to Argo Workflows TemplateEPSS 0.7%CVE-2026-42294HIGHArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorEPSS 0.6%CVE-2022-31102LOWCross-site Scripting for Argo CD single sign on usersEPSS 0.6%CVE-2025-59537HIGHargo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payloadEPSS 0.6%CVE-2025-62156HIGHargo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwriteEPSS 0.6%CVE-2025-59531HIGHUnauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadEPSS 0.5%