Login Request a demo
AR
Product
argo-cd
by argoproj · last CVE Oct 20, 2026
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities63In the news0Timeline
Severity mix
Critical 12High 22Medium 29Low 0
Severity
All severities63Critical12High22Medium29Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add argo-cd to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55797
8.8
2%
Oct 9
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Affected: >= 2.11.0, <= 2.14.21; >= 3.0.0, < 3.3.15; >= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.4; = 3.6.0-rc1
CVE-2023-22482
8.8
1%
Jan 26
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.8.2 before 2.3.14; 2.4.0 before 2.4.20; 2.5.0 before 2.5.8; 2.6.0; 2.6.0; 2.6.0; +1 more
CVE-2022-1025
8.8
1%
Jul 12
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to…
Affected: 0.5.0 through 2.1.12; 2.2.0 through 2.2.7; 2.3.0 through 2.3.1
CVE-2022-24768
8.8
1%
Mar 23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 0.5.0 before 2.1.14; 2.2.0 before 2.2.8; 2.3.0 before 2.3.2
CVE-2020-8828
8.8
2%
Apr 8
As of v1.5.0, the default admin password is set to the argocd-server pod name
Affected: before 1.5.0
CVE-2026-45738
8.7
1%
Jul 15
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Affected: < 3.2.12; >= 3.3.0, < 3.3.10; >= 3.4.0-rc1, < 3.4.2
CVE-2023-23947
8.5
1%
Feb 16
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.3.0 before 2.3.17; 2.4.0 before 2.4.23; 2.5.0 before 2.5.11; 2.6.0 before 2.6.2
CVE-2023-22736
8.5
1%
Jan 26
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.5.0 before 2.5.8; 2.6.0; 2.6.0; 2.6.0; 2.6.0
CVE-2024-22424
8.3
0%
Jan 19
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.8.0 before 2.8.8; 2.9.0 before 2.9.4; 2.10.0
CVE-2022-31034
8.1
1%
Jun 27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 0.11.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0
CVE-2026-43824
7.7
0%
May 2
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data
Affected: 3.2.0 before 3.2.11; 3.3.0 before 3.3.9
CVE-2022-24348
7.7
3%
Feb 4
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go
Affected: before 2.1.9; 2.2.0 before 2.2.4
CVE-2025-59538
7.5
9%
Oct 1
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Affected: >= 2.9.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19
CVE-2025-59537
7.5
1%
Oct 1
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
Affected: >= 1.2.0, <= 1.8.7; >= 2.0.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19
CVE-2025-59531
7.5
1%
Oct 1
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Affected: >= 1.2.0, <= 1.8.7; >= 2.0.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19
CVE-2024-40634
7.5
1%
Jul 22
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 1.0.0 before 2.9.20; 2.10.0 before 2.10.15; 2.11.0 before 2.11.6
CVE-2024-37152
7.5
2%
Jun 6
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.9.3 before 2.9.17; 2.10.0 before 2.10.12; 2.11.0 before 2.11.3
CVE-2024-21661
7.5
1%
Mar 18
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: before 2.8.13; 2.9.0 before 2.9.9; 2.10.0 before 2.10.4
CVE-2021-26923
7.5
2%
Mar 15
An issue was discovered in Argo CD before 1.8.4
Affected: before 1.7.12; 1.8.0 before 1.8.4
CVE-2020-8827
7.5
2%
Apr 8
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures
Affected: before 1.5.0
CVE-2020-8826
7.5
2%
Apr 8
As of v1.5.0, the Argo web interface authentication system issued immutable tokens
Affected: through 1.5.0
CVE-2023-40025
7.1
1%
Aug 23
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Affected: 2.6.0 through 2.6.13; 2.7.11; 2.8.0
Showing 22