CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Argo CD API Vulnerability Exposes Repository Credentials

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A critical vulnerability in Argo CD, tracked as CVE-2025-55190, allows API tokens with low-level project permissions to retrieve all repository credentials associated with a project. This flaw, rated with a maximum severity score of 10.0 in CVSS v3, impacts all versions of Argo CD up to 2.13.0. The vulnerability enables attackers to clone private codebases, inject malicious manifests, or pivot to other resources where the same credentials are reused. Argo CD is used by numerous large enterprises, including Adobe, Google, IBM, and Capital One, for handling large-scale, mission-critical deployments. The flaw bypasses isolation mechanisms designed to protect sensitive credential information, potentially leading to code theft, extortion, and supply chain attacks.

Timeline

  1. 05.09.2025 18:30 1 articles · 27d ago

    Argo CD API vulnerability (CVE-2025-55190) disclosed

    A critical vulnerability in Argo CD, tracked as CVE-2025-55190, allows API tokens with low-level project permissions to retrieve all repository credentials associated with a project. This flaw, rated with a maximum severity score of 10.0 in CVSS v3, impacts all versions of Argo CD up to 2.13.0. The vulnerability enables attackers to clone private codebases, inject malicious manifests, or pivot to other resources where the same credentials are reused. Argo CD is used by numerous large enterprises, including Adobe, Google, IBM, and Capital One, for handling large-scale, mission-critical deployments.

    Show sources
    Open in new tab

Information Snippets