Security Advisories · argoproj/argo-cd · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Certificate verification is skipped for connections to OIDC providers
GHSA-7943-82jg-wmw5 published Jul 12, 2022 by crenshaw-dev

High
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
GHSA-6gcg-hp2x-q54h published May 18, 2022 by jannfis

Moderate
Improper access control allows admin privilege escalation
GHSA-2f5v-8r3f-8pww published Mar 23, 2022 by alexmt

Critical
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
GHSA-r9cr-hvjj-496v published Mar 23, 2022 by jannfis

High
Path traversal allows leaking out-of-bound files from Argo CD repo-server
GHSA-h6h5-6fmq-rh28 published Mar 23, 2022 by jannfis

Moderate
Path traversal and dereference of symlinks when passing Helm value files
GHSA-63qx-x74g-jcr7 published Feb 3, 2022 by jannfis

High
Argo CD leaked secret data into error messages and logs on invalid edits via UI
GHSA-fp89-h8pj-8894 published Mar 15, 2021 by alexmt

Moderate
Possible XSS when using SSO with the CLI
GHSA-qq5v-f4c3-395c published Mar 8, 2021 by alexmt

Moderate
Helm OCI credentials leaked into Argo CD logs
GHSA-6w87-g839-9wv7 published Mar 8, 2021 by alexmt

Moderate
Unlimited validity of admin JWT
GHSA-9h6w-j7w4-jr52 published Mar 2, 2021 by alexmt

Critical