Database/Control plane, storage & DevOps
Argo CD: Secret values exposed in error messages and the diff view when an invalid Secret is synced
CVSS 6.8CVE-2025-23216Control plane, storage & DevOpscurated
Impact
Secret values exposed in error messages and the diff view when an invalid Secret is synced
Who can reach it
Network (remote)
What to do
Control-plane: upgrade + rotate any secret rendered in the UI
References
Related entries
- Argo CD: Tokens keep working after the user account is disabledCVE-2021-26921 · Argo CDMedium
- Argo CD: repo-server extracts a user-controlled tar.gz without size validationCVE-2023-40584 · Argo CDMedium
- Argo CD: Repo-server DoS, halting all GitOps reconciliationCVE-2024-29893 · Argo CDMedium
- Argo CD: Repository access credentials leaked in error messages surfaced in the UI and logsCVE-2023-25163 · Argo CDMedium
- Argo CD: /api/v1/settings exposes sensitive settings without authenticationCVE-2024-37152 · Argo CDMedium
- Argo CD: Unauthenticated attackers can enumerate existing applicationsCVE-2022-41354 · Argo CDMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.