argoproj has 45 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 8 in the last 90 days against 5 in the 90 before. The busiest recent month was October 2026 with 5. The median CVSS is 7.5 (high), with 10 rated critical. None have a confirmed exploitation report. Most affected products: github.com/argoproj/argo-cd/v2 (11), github.com/argoproj/argo-cd (10), argo_cd (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 5
Products
- github.com/argoproj/argo-cd/v2 11
- github.com/argoproj/argo-cd 10
- argo_cd 5
- argo-cd 4
- argo_workflows 4
- github.com/argoproj/argo-workflows/v4 3
Worst active — by depth score
CVE-2026-42880Critical· 9.6ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction65CVE-2026-113709Critical· 9.9Argo CD: A Kustomize Helm config home can run commands in the repo-server55CVE-2026-113708Critical· 9.9Argo CD: A Kustomize remote ref can run commands in the repo-server55CVE-2026-113672Critical· 9.9Argo CD: A Jsonnet import can read files from the repo-server55CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes55
argoproj vulnerabilities
CVEs affecting argoproj, newest first. Open any entry for full detail, references, and exploit status.
45 CVEsRSS
CVE-2026-113709Critical· 9.9Argo CD: A Kustomize Helm config home can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's conf…
CVE-2026-113708Critical· 9.9Argo CD: A Kustomize remote ref can run commands in the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch with…
CVE-2026-113672Critical· 9.9Argo CD: A Jsonnet import can read files from the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or import…
CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authoriz…
CVE-2026-55797High· 8.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git rep…
CVE-2026-93991High· 7.7Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. A…
CVE-2026-82277Critical· 9.8Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, Rest…
CVE-2026-54526HighArgo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
CVE-2026-45738High· 7.3Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rende…
CVE-2026-45737Medium· 6.3Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configura…
CVE-2026-42880Critical· 9.6PoCArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2026-42294High· 7.5Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
CVE-2026-42295HighArgo vulnerable to exposure of artifact repository credentials
Argo vulnerable to exposure of artifact repository credentials
CVE-2026-40886High· 7.7Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller
CVE-2026-28229High· 7.5Unauthorized access to Argo Workflows Template
Unauthorized access to Argo Workflows Template
CVE-2026-23960Medium· 5.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbit…
CVE-2025-66626High· 8.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archive…
CVE-2025-62157Medium· 6.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext…
CVE-2025-62156High· 8.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extrac…
CVE-2025-59538High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are n…
CVE-2025-59537High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the…
CVE-2025-59531High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the…
CVE-2025-47933Critical· 9.0Argo CD allows cross-site scripting on repositories page
Argo CD allows cross-site scripting on repositories page
CVE-2025-23216Medium· 6.8Argo CD does not scrub secret values from patch errors
Argo CD does not scrub secret values from patch errors
GHSA-274v-mgcv-cm8jMedium· 6.8Argo CD GitOps Engine does not scrub secret values from patch errors
Argo CD GitOps Engine does not scrub secret values from patch errors
CVE-2024-41666Medium· 4.7The Argo CD web terminal session does not handle the revocation of user permissions properly
The Argo CD web terminal session does not handle the revocation of user permissions properly
CVE-2024-37152Medium· 5.3PoCUnauthenticated Access to sensitive settings in Argo CD
Unauthenticated Access to sensitive settings in Argo CD
CVE-2024-36106Medium· 4.3Argo-cd authenticated users can enumerate clusters by name
Argo-cd authenticated users can enumerate clusters by name
CVE-2024-32476Medium· 6.5Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
CVE-2024-31990Medium· 4.8Argo CD's API server does not enforce project sourceNamespaces
Argo CD's API server does not enforce project sourceNamespaces