{"id":"CVE-2025-23216","published":"2025-01-30T15:30:05Z","modified":"2025-02-12T19:51:12Z","title":"Argo CD does not scrub secret values from patch errors","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00475,"percentile":0.40932,"provenance":"source"},"cwes":[{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca","tags":["x_refsource_MISC"]}],"priority":{"score":12.9,"factors":[{"name":"EPSS percentile","points":8.19},{"name":"CVSS severity","points":4.76}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 2.13.0, < 2.13.4",">= 2.12.0, < 2.12.10","< 2.11.13"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.13.0, <2.13.4",">=2.12.0, <2.12.10","<2.11.13"],"patched":["2.13.4","2.12.10","2.11.13"],"from":["GHSA-47g2-qmh2-749v","GO-2025-3433"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["<=1.8.7","all versions"],"patched":[],"from":["GHSA-47g2-qmh2-749v","GO-2025-3433"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-0130","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-37152","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-40634","published":"2024-07-22","fixed":"2.11.6","kev":false},{"cve":"CVE-2024-41666","published":"2024-07-24","fixed":"2.11.7","kev":false,"link":{"from":"CVE-2024-41666","to":"CVE-2025-23216","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.11.7","toFixed":"2.11.13","daysApart":190}]}},{"cve":"CVE-2025-23216","published":"2025-01-30","fixed":"2.13.4","kev":false},{"cve":"CVE-2025-47933","published":"2025-05-29","fixed":"2.14.13","kev":false,"link":{"from":"CVE-2025-23216","to":"CVE-2025-47933","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.13.4","toFixed":"2.13.8","daysApart":119}]}},{"cve":"CVE-2025-55190","published":"2025-09-04","fixed":"2.14.16","kev":false},{"cve":"CVE-2025-55191","published":"2025-09-30","fixed":"2.14.20","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}