Argo CD: Project API Token Exposes Repository Credentials
argoproj · argo-cd
The flaw lies in Argo CD, the GitOps continuous delivery tool for Kubernetes, where the project details API endpoint exposes sensitive repository credentials, such as usernames and passwords, to API tokens that hold project get permissions. An attacker holding such a token, including one with only standard application management permissions or a global projects, get permission, can retrieve those repository credentials over the network with no explicit secrets access, a low-privilege authenticated account, and no user interaction required.
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 months after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+2 mo
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in github.com/argoproj/argo-cd/v2 over 14 months. The latest fix listed for github.com/argoproj/argo-cd/v2 is 2.14.20.
Fixes in github.com/argoproj/argo-cd/v2Go package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 2.11.7CVE-2024-4166624 Jul 2024
- 2.13.4CVE-2025-2321630 Jan 2025
- 2.14.13CVE-2025-4793329 May 2025
- 2.14.16CVE-2025-551904 Sep 2025
- 2.14.20CVE-2025-5519130 Sep 2025
- 2.14.20CVE-2025-595311 Oct 2025
- 2.14.20CVE-2025-595371 Oct 2025Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV3 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Gogithub.com/argoproj/argo-cd/v2Affected: 2.14.0 up to 2.14.16; 2.13.0 up to 2.13.9Upgrade to 2.14.16 or later (older lines: 2.13.9)
- Gogithub.com/argoproj/argo-cd/v3Affected: 3.1.0-rc1 up to 3.1.2; All versions before 3.0.14Upgrade to 3.3.15 or later (older lines: 3.0.14)
- Gogithub.com/argoproj/argo-cdAffected: All versionsNo fixed version published