Argo CD: any token with project get permission can read repository credentials

Impact

An API token that only has standard application-management rights can read the usernames and passwords stored for Git and Helm repositories through the project details endpoint, including tokens holding only a global projects, get grant. On a GPU fleet where Argo CD is the GitOps controller for the whole cluster, those credentials are usually write-capable against the manifest repositories that define node pools, device-plugin DaemonSets, admission policy and inference deployments. An attacker who harvests them can push manifests that schedule privileged pods onto GPU nodes, so a low-privilege automation token converts into cluster-wide control without ever touching a Kubernetes Secret. Any team or tenant that was given a scoped Argo CD token is in the blast radius.

Who can reach it

Authenticated holder of any Argo CD API token with project get permission - a CI job token or a tenant-scoped automation account is enough. No access to Kubernetes Secrets and no admin role required; reachable wherever the Argo CD API is exposed.

What to do

Upgrade Argo CD to 2.13.9, 2.14.16, 3.0.14 or 3.1.2 and restart the argocd-server deployment - a control-plane component restart, no node drain or reboot. Because credentials may already have been read, rotate every repository credential and audit project get grants on existing tokens after patching.

References

Related entries

• Gardener provider extensions: code injection via Terraformer lets a project admin take over the seed clusterCVE-2025-59823 · Gardener provider extensions (Terraformer-based infrastructure provisioning)Critical
• StreamsHub Console operator: tenant-supplied container image runs with a cluster-wide Strimzi ServiceAccountCVE-2026-105312 · StreamsHub Console for Apache Kafka (Console CR operator, image field)Critical
• Argo CD repo-server: Jsonnet imports escape the repository root and read service-account tokensCVE-2026-113672 · Argo CD argocd-repo-server (Jsonnet import path confinement)Critical
• Argo CD repo-server: Kustomize ref value injects git --upload-pack and runs commands in the podCVE-2026-113708 · Argo CD argocd-repo-server (Kustomize remote ref passed to git fetch)Critical
• Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes itCVE-2026-113709 · Argo CD argocd-repo-server (Kustomize helmGlobals.configHome plugin loading)Critical
• Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted clusterCVE-2026-41050 · Rancher Fleet Helm deployer (ServiceAccount impersonation)Critical