Skip to content
OpenAdvisories

Package · Go

github.com/argoproj/argo-cd/v3

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55797 Public exploit

    Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured wit…

    argoproj Argo CD argo-cd-3.2-compat argo-cd-3.2 Wolfi Go
  • High 7.3
    CVE-2026-45738

    Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/appl…

    argoproj Argo CD argocd-image-updater argo-cd-3.2-compat Wolfi Go
  • High 7.5
    CVE-2025-59538 EPSS 11%

    Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default …

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2025-59537

    argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause …

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2025-59531

    Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause …

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go