Executive brief
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
Affected products
- Go github.com/argoproj/argo-cd
- Go github.com/argoproj/argo-cd/v3
- Go github.com/argoproj/argo-cd/v2
Junglewise Threat Intelligence
CVE-2025-55190: GO-2025-3934 - Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
CVE-2025-55190 · Severity: low · CVSS 3.1 · Published 2025-09-08
Technologies: github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v3 (Go), github.com/argoproj/argo-cd/v2 (Go). Vendors: Go.
Related threats
- Argo CD stored XSS in application link annotations
- Argo CD information exposure in ServerSideDiff
- Argo CD information disclosure in ServerSideDiff endpoint
- GO-2025-3993 - Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
- GO-2025-3995 - Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd