PT-2025-4855 · Argo Cd+1 · Argo Cd+1

Jannfis + 1 · Published 2025-01-30 · Updated 2025-06-06 · CVE-2025-23216

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to v2.13.4 Argo CD versions prior to v2.12.10 Argo CD versions prior to v2.11.13

Description A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.

Recommendations For versions prior to v2.13.4, update to v2.13.4 or later to fix the vulnerability. For versions prior to v2.12.10, update to v2.12.10 or later to fix the vulnerability. For versions prior to v2.11.13, update to v2.11.13 or later to fix the vulnerability. As a temporary workaround is not available, upgrading to the specified versions is the recommended course of action.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

BIT-ARGO-CD-2025-23216

CVE-2025-23216

GHSA-47G2-QMH2-749V

GO-2025-3433

OPENSUSE-SU-2025:14732-1

OPENSUSE-SU-2025_0429-1

SUSE-SU-2025:0429-1

Affected Products

Argo Cd

Suse

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23216.json · Exploit
• https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 · Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v · Patch
• https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca · Patch
• https://osv.dev/vulnerability/GO-2025-3433 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2025-23216 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47g2-qmh2-749v · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14732-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23216 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0429-1 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j · Note
• https://suse.com/security/cve/CVE-2024-3727 · Note
• https://suse.com/security/cve/CVE-2024-35177 · Note