{"id":"CVE-2022-41354","published":"2023-03-27T00:00:00Z","modified":"2026-07-09T00:21:35Z","title":"An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications","vendor":null,"product":null,"tier":"tail","description":{"text":"An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00643,"percentile":0.50825,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md","tags":[]},{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq","tags":[]}],"priority":{"score":10.2,"factors":[{"name":"EPSS percentile","points":10.16}]},"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":[">=0.5.0, <=1.8.7",">=0.5.0"],"patched":[],"from":["GHSA-2q5c-qw9c-fmvq","GO-2023-1670"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.5.0, <2.5.16",">=2.6.0, <2.6.7","<2.4.28"],"patched":["2.5.16","2.6.7","2.4.28"],"from":["GHSA-2q5c-qw9c-fmvq","GO-2023-1670"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0830","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-22736","published":"2023-01-26","fixed":"2.6.0-rc5","kev":false},{"cve":"CVE-2023-25163","published":"2023-02-08","fixed":"2.6.1","kev":false},{"cve":"CVE-2023-23947","published":"2023-02-16","fixed":"2.6.2","kev":false,"link":{"from":"CVE-2023-23947","to":"CVE-2022-41354","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.5.11","toFixed":"2.5.16","daysApart":39}]}},{"cve":"CVE-2022-41354","published":"2023-03-27","fixed":"2.6.7","kev":false},{"cve":"CVE-2023-40025","published":"2023-08-23","fixed":"2.8.1","kev":false,"link":{"from":"CVE-2022-41354","to":"CVE-2023-40025","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.6.7","toFixed":"2.6.14","daysApart":149}]}},{"cve":"CVE-2023-40029","published":"2023-09-07","fixed":"2.8.3","kev":false},{"cve":"CVE-2023-40584","published":"2023-09-07","fixed":"2.8.3","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}