PT-2025-5629 · Argo Cd · Argo Cd

Published 2025-01-30 · Updated 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.13.4 Argo CD versions prior to 2.12.10 Argo CD versions prior to 2.11.13

Description: A vulnerability was discovered that exposes secret values in error messages and the diff view when an invalid Kubernetes Secret resource is synced from a repository. This issue can be exploited by a user with write access to the repository, who can commit an invalid Secret and trigger a Sync, intentionally or unintentionally. Once exploited, any user with read access to Argo CD can view the exposed secret data.

Recommendations: For versions prior to 2.13.4, update to version 2.13.4 or later. For versions prior to 2.12.10, update to version 2.12.10 or later. For versions prior to 2.11.13, update to version 2.11.13 or later.

Fix

Related Identifiers

GHSA-274V-MGCV-CM8J

Affected Products

Argo Cd

References · 7

• https://osv.dev/vulnerability/GHSA-274v-mgcv-cm8j · Vendor Advisory
• https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 · Note
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v · Note
• https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca · Note
• https://github.com/argoproj/gitops-engine · Note
• https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j · Note
• https://pkg.go.dev/vuln/GO-2025-3437 · Note