Argo CD
Argo CD is a declarative GitOps continuous delivery tool for Kubernetes. It syncs desired state from Git into the cluster and often holds cluster-admin credentials, so API and Redis flaws escalate quickly. NVD tracks it as cpe:2.3:a:argoproj:argo_cd with multi-branch semver CPE ranges.
Querying Argo CD
argo_cd2.1.8, 2.14.20curl "https://api.attestd.io/v1/check?product=argo_cd&version=2.1.8" \
-H "Authorization: Bearer $ATTESTD_KEY"Argo CD 2.1.8 sits in the CVE-2022-29165 window: an unauthenticated attacker with network access to the Argo CD API can gain admin. The example response also reflects overlapping repo-server disclosure CVEs on that line.
{
"product": "argo_cd",
"version": "2.1.8",
"supported": true,
"risk_state": "high",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2022-1025",
"CVE-2022-24348",
"CVE-2022-24730",
"CVE-2022-24731",
"CVE-2022-24768",
"CVE-2022-24904",
"CVE-2022-24905",
"CVE-2022-29165",
"CVE-2022-31016",
"CVE-2022-31034",
"CVE-2022-31035",
"CVE-2023-22482",
"CVE-2023-40026",
"CVE-2023-50726",
"CVE-2024-21652",
"CVE-2024-21661",
"CVE-2024-21662",
"CVE-2024-28175",
"CVE-2024-31989",
"CVE-2024-32476",
"CVE-2024-36106",
"CVE-2024-40634",
"CVE-2025-23216",
"CVE-2025-47933",
"CVE-2025-55191",
"CVE-2025-59531",
"CVE-2025-59537",
"CVE-2026-15416",
"CVE-2026-45738",
"CVE-2026-62185"
],
"cves": null,
"max_epss": 0.02693,
"last_updated": "2026-08-16T05:53:58.586317Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Argo CD 2.14.20 is past the fixed branch cuts for CVE-2022-29165, CVE-2024-21652, CVE-2024-31989, and CVE-2023-40029.
curl "https://api.attestd.io/v1/check?product=argo_cd&version=2.14.20" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Argo CD advisories often publish concurrent fixes across supported minor branches. Critical issues target the API server, Redis cache, and secret exposure in declaratively managed clusters. A single unauthenticated foothold on the control plane can become cluster admin.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2022-29165 | Unauthenticated attacker with network access to the Argo CD API gains admin. | ≥1.4.0 <2.1.15 / ≥2.2.0 <2.2.9 / ≥2.3.0 <2.3.4 | 10.0 |
CVE-2024-21652 | Vulnerability chain enables full compromise of the Argo CD server. | <2.8.13 / ≥2.9.0 <2.9.9 / ≥2.10.0 <2.10.4 | 9.8 |
CVE-2024-31989 | Unprivileged pod reaches Redis and can escalate to cluster admin via Argo CD state. | <2.8.19 / ≥2.9.0 <2.9.15 / ≥2.10.0 <2.10.10 / ≥2.11.0 <2.11.1 | 9.0 |
CVE-2023-40029 | Declaratively managed cluster secrets expose full secret body to unauthorized readers. | ≥2.2.0 <2.6.15 / ≥2.7.0 <2.7.14 / ≥2.8.0 <2.8.3 | 9.6 |
KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.
argoproj:argo_cd CPE
NVD uses a single Argoproj product identifier with overlapping semver ranges across supported minor branches.
cpe:2.3:a:argoproj:argo_cdAPI, Redis, and secret-exposure CVEsAttestd maps the argo_cd slug to this namespace and merges multi-branch ranges into one check response.