Login Request a demo
AR
Product
argo-cd
by argoproj · last CVE Oct 20, 2026
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities63In the news0Timeline
Severity mix
Critical 12High 22Medium 29Low 0
Severity
All severities63Critical12High22Medium29Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add argo-cd to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-29165
10.0
2%
May 20
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.4.0 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4
CVE-2026-113709
9.9
1%
Oct 20
Argo CD: A Kustomize Helm config home can run commands in the repo-server
Affected: >= 2.1.0, < 3.3.15; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-113708
9.9
1%
Oct 20
Argo CD: A Kustomize remote ref can run commands in the repo-server
Affected: >= 2.7.0, < 3.3.15; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-113672
9.9
1%
Oct 20
Argo CD: A Jsonnet import can read files from the repo-server
Affected: >= 0.9.0, < 3.3.1; >= 3.4.0-rc1, < 3.4.10; >= 3.5.0-rc1, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2026-77459
9.9
0%
Oct 13
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Affected: >= 2.10.0, <= 2.14.21; >= 3.0.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4; >= 3.6.0-rc1, < 3.6.0-rc2
CVE-2025-55190
9.9
6%
Sep 4
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.2.0 before 2.13.9; 2.14.0 before 2.14.16; 3.0.0 before 3.0.14; 3.1.0 before 3.1.2
CVE-2024-21652
9.8
1%
Mar 18
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.8.13; 2.9.0 before 2.9.9; 2.10.0 before 2.10.4
CVE-2026-42880
9.6
1%
May 7
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
Affected: >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9
CVE-2023-40029
9.6
1%
Sep 7
Argo CD is a declarative continuous deployment for Kubernetes
Affected: 2.2.0 before 2.6.15; 2.7.0 before 2.7.14; 2.8.0 before 2.8.3
CVE-2022-31105
9.6
1%
Jul 12
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.3.0 before 2.3.6; 2.4.0 before 2.4.5
CVE-2024-21662
9.1
1%
Mar 18
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.8.13; 2.9.0 before 2.9.9; 2.10.0 before 2.10.4
CVE-2024-31989
9.0
1%
May 21
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.8.19; 2.9.0 before 2.9.15; 2.10.0 before 2.10.10; 2.11.0 before 2.11.1
CVE-2026-55797
8.8
2%
Oct 9
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Affected: >= 2.11.0, <= 2.14.21; >= 3.0.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4; = 3.6.0-rc1
CVE-2023-22482
8.8
1%
Jan 26
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.8.2 before 2.3.14; 2.4.0 before 2.4.20; 2.5.0 before 2.5.8; 2.6.0; 2.6.0; 2.6.0; +1 more
CVE-2022-1025
8.8
1%
Jul 12
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to…
Affected: 0.5.0 through 2.1.12; 2.2.0 through 2.2.7; 2.3.0 through 2.3.1
CVE-2022-24768
8.8
1%
Mar 23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 0.5.0 before 2.1.14; 2.2.0 before 2.2.8; 2.3.0 before 2.3.2
CVE-2020-8828
8.8
2%
Apr 8
As of v1.5.0, the default admin password is set to the argocd-server pod name
Affected: before 1.5.0
CVE-2026-45738
8.7
1%
Jul 15
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Affected: < 3.2.12; >= 3.3.0, < 3.3.10; >= 3.4.0-rc1, < 3.4.2
CVE-2023-23947
8.5
1%
Feb 16
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.3.0 before 2.3.17; 2.4.0 before 2.4.23; 2.5.0 before 2.5.11; 2.6.0 before 2.6.2
CVE-2023-22736
8.5
1%
Jan 26
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.5.0 before 2.5.8; 2.6.0; 2.6.0; 2.6.0; 2.6.0
CVE-2024-22424
8.3
0%
Jan 19
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.8.0 before 2.8.8; 2.9.0 before 2.9.4; 2.10.0
CVE-2022-31034
8.1
1%
Jun 27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 0.11.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0
CVE-2026-43824
7.7
0%
May 2
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data
Affected: 3.2.0 before 3.2.11; 3.3.0 before 3.3.9
CVE-2022-24348
7.7
3%
Feb 4
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go
Affected: before 2.1.9; 2.2.0 before 2.2.4
CVE-2025-59538
7.5
9%
Oct 1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.9.0 before 2.14.20; 3.0.0 before 3.0.19; 3.1.0 before 3.1.8; 3.2.0
CVE-2025-59537
7.5
1%
Oct 1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.2.0 through 1.8.7; 2.0.0 before 2.14.20; 3.0.0 before 3.0.19; 3.1.0 before 3.1.8; 3.2.0
CVE-2025-59531
7.5
1%
Oct 1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.2.0 through 1.8.7; 2.0.0 before 2.14.20; 3.0.0 before 3.0.19; 3.1.0 before 3.1.8; 3.2.0
CVE-2024-40634
7.5
1%
Jul 22
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.0.0 before 2.9.20; 2.10.0 before 2.10.15; 2.11.0 before 2.11.6
CVE-2024-37152
7.5
2%
Jun 6
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.9.3 before 2.9.17; 2.10.0 before 2.10.12; 2.11.0 before 2.11.3
CVE-2024-21661
7.5
1%
Mar 18
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.8.13; 2.9.0 before 2.9.9; 2.10.0 before 2.10.4
CVE-2021-26923
7.5
2%
Mar 15
An issue was discovered in Argo CD before 1.8.4
Affected: before 1.7.12; 1.8.0 before 1.8.4
CVE-2020-8827
7.5
2%
Apr 8
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures
Affected: before 1.5.0
CVE-2020-8826
7.5
2%
Apr 8
As of v1.5.0, the Argo web interface authentication system issued immutable tokens
Affected: through 1.5.0
CVE-2023-40025
7.1
1%
Aug 23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.6.0 through 2.6.13; 2.7.11; 2.8.0
CVE-2025-23216
6.8
0%
Jan 30
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.11.13; 2.12.0 before 2.12.10; 2.13.0 before 2.13.4
CVE-2026-45737
6.5
1%
Jul 15
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Affected: >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2
CVE-2024-41666
6.5
1%
Jul 24
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.6.0 before 2.9.21; 2.10.0 before 2.10.16; 2.11.0 before 2.11.7
CVE-2024-32476
6.5
1%
May 14
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.1.0 before 2.8.17; 2.9.0 before 2.9.13; 2.10.0 before 2.10.8
CVE-2024-29893
6.5
1%
Mar 29
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.4.0 before 2.8.14; 2.9.0 before 2.9.10; 2.10.0 before 2.10.5
CVE-2023-40584
6.5
1%
Sep 7
Argo CD is a declarative continuous deployment for Kubernetes
Affected: 2.4.0 before 2.6.15; 2.7.0 before 2.7.14; 2.8.0 before 2.8.3
CVE-2023-25163
6.5
1%
Feb 8
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +2 more
CVE-2022-31016
6.5
1%
Jun 25
Argo CD is a declarative continuous deployment for Kubernetes
Affected: 0.7.0 before 2.1.16; 2.2.0 before 2.2.10; 2.3.0 before 2.3.5; 2.4.0 before 2.4.1
CVE-2022-24730
6.5
1%
Mar 23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.3.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0
CVE-2021-3557
6.5
1%
Feb 16
A flaw was found in argocd
Affected: before 1.1.1
CVE-2021-26921
6.5
1%
Feb 9
In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled
Affected: before 1.7.12; 1.8.0 before 1.8.4
CVE-2018-21034
6.5
1%
Apr 9
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git
Affected: through 1.4.2
CVE-2023-50726
6.4
1%
Mar 13
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.2.0 before 2.8.12; 2.9.0 before 2.9.7; 2.10.0 before 2.10.3
CVE-2024-31990
6.3
0%
Apr 15
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.4.0 before 2.8.16; 2.9.0 before 2.9.12; 2.10.0 before 2.10.7
CVE-2022-31102
6.1
1%
Jul 12
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.3.0 before 2.3.6; 2.4.0 before 2.4.5
CVE-2021-26924
6.1
1%
Mar 15
An issue was discovered in Argo CD before 1.8.4
Affected: before 1.7.12; 1.8.0 before 1.8.4
Page 1 of 2 · 63 total
12