Skip to content
OpenAdvisories
Medium · 5.3 CVE-2022-41354 EUVD-2023-0830GHSA-2q5c-qw9c-fmvqGO-2023-1670

Argo CD authenticated but unauthorized users may enumerate Application names via the API

Published Mar 27, 2023 · Updated Jul 9, 2026 · Assigned by mitre

Package: github.com/argoproj/argo-cd Package: github.com/argoproj/argo-cd/v2 Ecosystem: Go

Description

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/argoproj/argo-cd >= 0.5.0, <= 1.8.7 — GHSA-2q5c-qw9c-fmvq
Go github.com/argoproj/argo-cd >= 0.5.0 — GO-2023-1670
Go github.com/argoproj/argo-cd/v2 >= 2.5.0, < 2.5.16 2.5.16 GHSA-2q5c-qw9c-fmvq
Go github.com/argoproj/argo-cd/v2 >= 2.6.0, < 2.6.7 2.6.7 GHSA-2q5c-qw9c-fmvq
Go github.com/argoproj/argo-cd/v2 < 2.4.28 2.4.28 GHSA-2q5c-qw9c-fmvq
Go github.com/argoproj/argo-cd/v2 < 2.4.28 · >= 2.5.0, < 2.5.16 · >= 2.6.0, < 2.6.7 2.4.28, 2.5.16, 2.6.7 GO-2023-1670

Advisories 1

References