argoproj vulnerabilities

CVEs per yearBy the year they were published

1. 202214
2. 202417
3. 20249
4. 202511
5. 202623

Newest CVEs

• CVE-2026-113709

  Argo CD: A Kustomize Helm config home can run commands in the repo-server

  argoproj · argo-cd

  Critical9.9
• CVE-2026-113708

  Argo CD: A Kustomize remote ref can run commands in the repo-server

  argoproj · argo-cd

  Critical9.9
• CVE-2026-113672

  Argo CD: A Jsonnet import can read files from the repo-server

  argoproj · argo-cd

  Critical9.9
• CVE-2026-77459

  Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

  argoproj · argo-cd

  Critical9.9
• CVE-2026-55797

  Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

  argoproj · argo-cd

  High8.8
• CVE-2026-93991

  Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

  argoproj · argo-workflows

  High8.3
• CVE-2026-82277

  Argo Rollouts Dashboard Unauthenticated Mutating Operations

  argoproj · argo-rollouts

  Critical9.3
• CVE-2026-54526

  Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

  argoproj · argo-workflows

  High8.9
• CVE-2026-45737

  Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

  argoproj · argo-cd

  Medium6.3
• CVE-2026-45738

  Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

  argoproj · argo-cd

  High7.3