CVE-2025-23216
Fixed in a distro release EPSS <1%CVSS 6.8
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.
Products: argoproj argo-cd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix |
| Go | github.com/argoproj/argo-cd/v2 | 2.13.4 |
| Go | github.com/argoproj/argo-cd/v2 | 2.12.10 |
| Go | github.com/argoproj/argo-cd/v2 | 2.11.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.11 | 0 |
| Chainguard | argo-cd-2.11-compat | 0 |
| Chainguard | argo-cd-2.11-repo-server | 0 |
| Chainguard | argo-cd-2.12 | 0 |
| Chainguard | argo-cd-2.12-compat | 0 |
| Chainguard | argo-cd-2.12-repo-server | 0 |
| Chainguard | argo-cd-2.13 | 0 |
| Chainguard | argo-cd-2.13-compat | 0 |
| Chainguard | argo-cd-2.13-repo-server | 0 |
| Chainguard | argo-cd-2.14 | 0 |
| Chainguard | argo-cd-2.14-compat | 0 |
| Chainguard | argo-cd-2.14-repo-server | 0 |
| Chainguard | argo-cd-fips-2.11 | 0 |
| Chainguard | argo-cd-fips-2.11-compat | 0 |
| Chainguard | argo-cd-fips-2.11-repo-server | 0 |
| Chainguard | argo-cd-fips-2.12 | 0 |
| Chainguard | argo-cd-fips-2.12-compat | 0 |
| Chainguard | argo-cd-fips-2.12-repo-server | 0 |
| Chainguard | argo-cd-fips-2.13 | 0 |
| Chainguard | argo-cd-fips-2.13-compat | 0 |
| Chainguard | argo-cd-fips-2.13-repo-server | 0 |
| Chainguard | argo-cd-fips-2.14 | 0 |
| Chainguard | argo-cd-fips-2.14-compat | 0 |
| Chainguard | argo-cd-fips-2.14-repo-server | 0 |
| Chainguard | argocd-image-updater | 0.15.2-r3 |
| Chainguard | argocd-image-updater-compat | 0.15.2-r3 |
| Chainguard | argocd-image-updater-fips | 0.15.2-r2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250207T224745-150000.1.32.1 |
| Wolfi | argo-cd-2.11 | 0 |
| Wolfi | argo-cd-2.11-compat | 0 |
| Wolfi | argo-cd-2.11-repo-server | 0 |
| Wolfi | argo-cd-2.12 | 0 |
| Wolfi | argo-cd-2.12-compat | 0 |
| Wolfi | argo-cd-2.12-repo-server | 0 |
| Wolfi | argo-cd-2.13 | 0 |
| Wolfi | argo-cd-2.13-compat | 0 |
| Wolfi | argo-cd-2.13-repo-server | 0 |
| Wolfi | argo-cd-2.14 | 0 |
| Wolfi | argo-cd-2.14-compat | 0 |
| Wolfi | argo-cd-2.14-repo-server | 0 |
| Wolfi | argocd-image-updater | 0.15.2-r3 |
| Wolfi | argocd-image-updater-compat | 0.15.2-r3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20250207T224745-150000.1.32.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250204T220613-1.1 |