Database/Container, Kubernetes & orchestration
Argo CD: Directory traversal via Helm charts discloses credentials from other Applications' value files
CVSS 7.7CVE-2022-24348Container, Kubernetes & orchestrationcurated
Impact
Directory traversal via Helm charts discloses credentials from other Applications' value files; cross-tenant secret leak
Who can reach it
Any user with repo write access
What to do
Rolling Argo CD upgrade; rotate any credentials stored in chart values
References
Related entries
- Argo CD: Path traversal plus improper access control in the repo-serverCVE-2022-24730 · Argo CDHigh
- Argo CD: /api/version leaks internal system information without authenticationCVE-2021-26923 · Argo CDHigh
- Argo CD: Large JSON payload to /api/webhook DoSes the API server from an unauthenticated positionCVE-2024-40634 · Argo CDHigh
- Argo CD: Azure DevOps webhook credentials mishandled, allowing unauthorised webhook useCVE-2025-59538 · Argo CDHigh
- Argo CD: Secret values exposed in error messages and the diff view when an invalid Secret is syncedCVE-2025-23216 · Argo CDMedium
- Argo CD: Tokens keep working after the user account is disabledCVE-2021-26921 · Argo CDMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.