Fluid Attacks Database

Description

Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/argoproj/argo-cd/v2	>=2.13.0 <2.13.9 \|\| >=2.14.0 <2.14.16	2.13.9, 2.14.16
go	github.com/argoproj/argo-cd/v3	>=0 <3.0.14 \|\| >=3.1.0-rc1 <3.1.2	3.0.14, 3.1.2
go	github.com/argoproj/argo-cd	-	-

Aliases

1. CVE-2025-551902. NVD-2025-551903. OSV-2025-551904. OSV-GO-2025-39345. GHSA-786q-9hcg-v9ff6. GCVE-2025-551907. GHSA-786q-9hcg-v9ff

References

1. https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff2. https://github.com/argoproj/argo-cd/commit/e8f86101f5378662ae6151ce5c3a76e9141900e83. https://vulncheck.com/cve/CVE-2025-551904. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55190.yaml