Do Son Four critical Argo CD vulnerabilities, including AppProject bypass CVE-2026-77459, threaten the repo-server and clusters. Upgrade to v3.5.4 now.
Argo CD
A critical 9.6 CVSS flaw in Argo CD (CVE-2026-42880) allows read-only users to extract plaintext Kubernetes secrets via Server-Side Diffs. Patch to v3.3.9 now!
Argo CD patches multiple High-severity DoS flaws. A single unauthenticated webhook request can crash the entire argocd-server process via improper JSON handling.
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
The CVE-2024-31989 vulnerability affects anyone who does not have strict access controls on their Redis instance
A serious cross-site scripting (XSS) vulnerability (CVE-2024-28175, CVSS 9.0) has been discovered in Argo CD
The first vulnerability (CVE-2023-40029, CVSS score of 9.9) allows an attacker to view the full contents of a cluster secret.
Tracked as CVE-2023-23947 (CVSS score of 9.1), the bug exists due to improper authorization, was introduced in Argo CD version v2.3.0-rc1
Argo CD users are advised to update to a fixed version of the platform as soon as possible as no workarounds are available for CVE-2023-22482