Database/Container, Kubernetes & orchestration
Argo CD: Repository access credentials leaked in error messages surfaced in the UI and logs
CVSS 6.3CVE-2023-25163Container, Kubernetes & orchestrationcurated
Impact
Repository access credentials leaked in error messages surfaced in the UI and logs
Who can reach it
Any Argo CD user who can trigger a sync error
What to do
Rolling Argo CD upgrade; rotate repo credentials
References
Related entries
- Argo CD: /api/v1/settings exposes sensitive settings without authenticationCVE-2024-37152 · Argo CDMedium
- Argo CD: Unauthenticated attackers can enumerate existing applicationsCVE-2022-41354 · Argo CDMedium
- Argo CD: Unauthenticated attacker forges JWTs and gains full Argo CD admin, which in a GitOps clusterCVE-2022-29165 · Argo CDCritical
- Argo CD: Improper access control allows a low-privileged user to escalate to Argo CD adminCVE-2022-24768 · Argo CDCritical
- Argo CD: Cluster secrets stored in the last-applied-configuration annotation are readable by anyone with get accessCVE-2023-40029 · Argo CDCritical
- Argo CD: Chained DoS plus in-memory data manipulation lets an attacker bypass authenticationCVE-2024-21652 · Argo CDCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.