Argo CD does not scrub secret values from patch errors

CVE-2025-23216 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.

The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.

Patches

A patch for this vulnerability is available in the following Argo CD versions:
- v2.13.4
- v2.12.10
- v2.11.13

Workarounds

There is no workaround other than upgrading.

References

Fixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2025-01-30 17:52:45 UTC
Updated
2025-06-07 00:33:37 UTC
GitHub reviewed
2025-01-30 17:52:45 UTC
NVD published
2025-01-30

EPSS Score

Score Percentile
0.48% 65.30%

CVSS Scores

Base score Version Severity Vector
6.8 3.1 —
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H)
They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-47g2-qmh2-749v ↗
CVE CVE-2025-23216 ↗

CWEs

CWE id Name
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-209 Generation of Error Message Containing Sensitive Information

Credits

  • svghadi (remediation_developer)

Affected packages (4)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go github.com/argoproj/argo-cd/v2 >= 2.13.0, < 2.13.4 2.13.4 —
go github.com/argoproj/argo-cd/v2 >= 2.12.0, < 2.12.10 2.12.10 —
go github.com/argoproj/argo-cd/v2 < 2.11.13 2.11.13 —
go github.com/argoproj/argo-cd <= 1.8.7 — —

References

cvelogic Threat Intelligence