Vendor
Argo CD
88 known vulnerabilities in products by Argo CD, 0 of them actively exploited (CISA KEV).
Key figures
88
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
22
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-55190 | Argo CD: Project API Token Exposes Repository Credentials | 10.0 | |
| High | CVE-2026-55797 | Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | 8.8 | |
| High | CVE-2025-59538 | Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | 7.5 | |
| Critical | CVE-2026-113672 | Argo CD: A Jsonnet import can read files from the repo-server | 9.9 | |
| Critical | CVE-2022-29165 | Argo CD will blindly trust JWT claims if anonymous access is enabled | 10.0 | |
| Critical | CVE-2026-113708 | Argo CD: A Kustomize remote ref can run commands in the repo-server | 9.9 | |
| Critical | CVE-2026-82277 | Argo Rollouts Dashboard Unauthenticated Mutating Operations | 9.8 | |
| High | CVE-2022-24348 | Argo CD: Path Traversal | 7.7 | |
| Critical | CVE-2026-113709 | Argo CD: A Kustomize Helm config home can run commands in the repo-server | 9.9 | |
| Critical | CVE-2024-31989 | ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache | 9.1 | |
| Critical | CVE-2026-77459 | Argoproj Argo-cd: Incorrect Authorization | 9.9 | |
| High | CVE-2020-8828 | Argo CD: Privilege Escalation | 8.8 | |
| High | CVE-2020-8827 | Argo CD: security vulnerability | 7.5 | |
| Critical | CVE-2023-40029 | Cluster secret might leak in cluster details page in Argo CD | 9.9 | |
| Critical | CVE-2022-24768 | Improper access control allows admin privilege escalation in Argo CD | 9.9 | |
| High | CVE-2024-37152 | Unauthenticated Access to sensitive settings in Argo CD | 5.3 | |
| Critical | CVE-2026-54526 | Argoproj Argo-workflows: Improper Access Control | 9.9 | |
| Critical | CVE-2026-42880 | ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | 9.6 | |
| High | CVE-2022-1025 | ArgoCD: Improper Access Control | 8.8 | |
| Critical | CVE-2026-28229 | Argo Workflows has unauthorized access to Argo Workflows Template | 9.8 | |
| High | CVE-2020-8826 | Argo CD: security vulnerability | 7.5 | |
| High | CVE-2024-40634 | Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint | 7.5 | |
| High | CVE-2022-31054 | Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events | 7.5 | |
| Critical | CVE-2025-32445 | Users can gain privileged access to the host system and cluster with EventSource and Sensor CR | 10.0 | |
| High | CVE-2026-45738 | Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | 8.7 |
News
Products
| Argo CD | 107 | 0 |
| Argo-workflows | 34 | 0 |
| Argo-helm | 4 | 0 |