CVE-2025-23216

Argo CD does not scrub secret values from patch errors

State: Published
Severity: 6.8 Medium
Published: Jan 30, 2025
Updated: Feb 12, 2025
Reserved: Jan 13, 2025

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
argo-cdargoproj	>= 2.13.0, < 2.13.4Affected >= 2.12.0, < 2.12.10Affected < 2.11.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.