CVE-2025-23216

MEDIUM EPSS 36.4%
Published Jan 30, 20251y ago · Modified Jun 17, 20261w ago
6.8 CVSS 3.1
Medium
Find Similar
Published Jan 30, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.

CVSS Details

Base Score
6.8
Exploitability
2.3
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
36.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-209

Affected Products 3

VendorProductVersionRange
argoprojargo_cd* <2.11.13
argoprojargo_cd*≥2.12.0  –  <2.12.10
argoprojargo_cd*≥2.13.0  –  <2.13.4

References 3

  • github.com https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107
    Patch
  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v
    PatchVendor Advisory
  • github.com https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca
    Patch

Remediation

  • github.com https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107
    Patch
  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v
    PatchVendor Advisory
  • github.com https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca
    Patch