argoproj has 45 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 8 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 5. The median CVSS is 7.5 (high), with 10 rated critical. None have a confirmed exploitation report. Most affected products: github.com/argoproj/argo-cd/v2 (11), github.com/argoproj/argo-cd (10), argo_cd (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 2
Products
- github.com/argoproj/argo-cd/v2 11
- github.com/argoproj/argo-cd 10
- argo_cd 5
- argo-cd 4
- argo_workflows 4
- github.com/argoproj/argo-workflows/v4 3
Worst active — by depth score
CVE-2026-42880Critical· 9.6ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction65CVE-2026-113709Critical· 9.9Argo CD: A Kustomize Helm config home can run commands in the repo-server55CVE-2026-113708Critical· 9.9Argo CD: A Kustomize remote ref can run commands in the repo-server55CVE-2026-113672Critical· 9.9Argo CD: A Jsonnet import can read files from the repo-server55CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes55
argoproj vulnerabilities
CVEs affecting argoproj, newest first. Open any entry for full detail, references, and exploit status.
45 CVEsRSS
CVE-2024-29893Medium· 6.5ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
CVE-2024-21661High· 7.5Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2024-21652Medium· 5.4Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
CVE-2024-28175Critical· 9.0Cross-site scripting on application summary component
Cross-site scripting on application summary component
CVE-2023-50726Medium· 6.4Users with `create` but not `override` privileges can perform local sync
Users with `create` but not `override` privileges can perform local sync
CVE-2024-22424High· 8.3github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability
CVE-2023-40026Medium· 5.0Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
CVE-2022-41354Medium· 5.3Argo CD authenticated but unauthorized users may enumerate Application names via the API
Argo CD authenticated but unauthorized users may enumerate Application names via the API
CVE-2023-23947Critical· 9.1Users with any cluster secret update access may update out-of-bounds cluster secrets
Users with any cluster secret update access may update out-of-bounds cluster secrets
CVE-2023-22736High· 8.5Controller reconciles apps outside configured namespaces when sharding is enabled
Controller reconciles apps outside configured namespaces when sharding is enabled
CVE-2022-25856High· 7.5Insecure path traversal in Git Trigger Source can lead to arbitrary file read
Insecure path traversal in Git Trigger Source can lead to arbitrary file read
CVE-2022-24904Medium· 4.3Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
CVE-2022-1025Critical· 9.9Improper access control allows admin privilege escalation in Argo CD
Improper access control allows admin privilege escalation in Argo CD
CVE-2022-24348High· 7.7PoCPath traversal and dereference of symlinks in Argo CD
Path traversal and dereference of symlinks in Argo CD
CVE-2021-23347Medium· 4.7Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2