Warning: Undefined variable $comments_html in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 527

Max severity Argo CD API flaw leaks repository credentials

A critical security vulnerability has been discovered in Argo CD, a popular continuous delivery tool for Kubernetes. This flaw in the Argo CD API can leak repository credentials, potentially exposing sensitive data and allowing unauthorized access to source code repositories. The vulnerability has been assigned a maximum severity rating, underscoring the urgent need for organizations using Argo CD to update to the latest patched version immediately. Attackers exploiting this flaw could gain access to private repositories, leading to further compromise of development pipelines and infrastructure. The issue highlights the importance of securing CI/CD tools and regularly auditing API endpoints for security weaknesses. Users are advised to follow best practices in credential management and monitor for unusual activity in their environments. This incident serves as a critical reminder of the risks associated with misconfigured or vulnerable APIs in modern DevOps workflows, emphasizing the need for continuous security assessments and prompt patching to protect software supply chains.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 05 Sep 2025 15:30:25 +0000

Cyber News related to Max severity Argo CD API flaw leaks repository credentials

Warning: Undefined array key "host" in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 364

Warning: Undefined variable $domain_html in /home/u319666691/domains/cybersecurityboard.com/public_html/_template.php on line 466

CVE-2024-22424 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery (CSRF) attack when the attacker has the ability to write ...
1 year ago

CVE-2023-22482 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain ...
2 years ago

CVE-2022-29165 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to ...
3 years ago

Defining Good: A Strategic Approach to API Risk Reduction - A good API security strategy starts with a well thought out API security posture governance program that spans from design to deployment. That standard, if communicated and enforced effectively, will not only positively affect how a developer designs ...
1 year ago Securityboulevard.com

Max severity Argo CD API flaw leaks repository credentials - A critical security vulnerability has been discovered in Argo CD, a popular continuous delivery tool for Kubernetes. This flaw in the Argo CD API can leak repository credentials, potentially exposing sensitive data and allowing unauthorized access to ...
5 hours ago Bleepingcomputer.com CVE-2024-25645

Salt Security Delivers API Posture Governance Engine - PRESS RELEASE. PALO ALTO, Calif., Jan. 17, 2024 /PRNewswire/ - Salt Security, the leading API security company, today announced multiple advancements in discovery, posture management and AI-based threat protection to the industry leading Salt ...
1 year ago Darkreading.com

Imperva Named an Overall Leader in the KuppingerCole Leadership Compass: API Security and Management Report - We're thrilled to share that Imperva has achieved the prestigious status of Overall Leader in the KuppingerCole Leadership Compass: API Security and Management report. A notable achievement is being recognized as one of the few non-gateway-first ...
1 year ago Imperva.com

That time I broke into an API and became a billionaire - This included an internal API with a dependency on a third-party banking API. We'll get to the banking API later in this story. That's all thanks to developers embracing agile development, microservices, and API gateway redirection that exposed ...
1 year ago Securityboulevard.com

CVE-2022-24730 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a ...
2 years ago

Unified API Protection - A massive segment of organizations' digital footprint today is built around internal and external APIs. As more IT leaders realize and acknowledge the size of APIs' influence, it's become clear that new methods are needed to secure those APIs. While ...
2 years ago Cequence.ai

CVE-2022-24904 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write ...
3 years ago

CVE-2022-31036 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from ...
3 years ago

What do CISOs need to know about API security in 2024? - According to Postman's 2023 State of the API Report, roughly 66% of participants indicated that their APIs contribute to generating revenue. A recent ESG survey on API security showed that 92% of organisations using APIs have experienced a breach in ...
1 year ago Cybersecurity-insiders.com

Three New Critical Vulnerabilities Uncovered in Argo - Security researchers have discovered three critical vulnerabilities within Argo, a popular GitOps continuous delivery tool used in Kubernetes setups. The vulnerabilities, identified by KTrust's in-house researchers, pose significant risks to system ...
1 year ago Infosecurity-magazine.com CVE-2024-21662 CVE-2024-21652 CVE-2024-21661

API Gateways and API Protection: What’s the Difference? - Security Boulevard - At the security level, API security tools and gateways provide different controls to protect APIs from various threats. API protection – or API security – refers to a comprehensive set of security capabilities designed to protect APIs from a wide ...
11 months ago Securityboulevard.com

CVE-2023-25163 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible ...
2 years ago

CVE-2021-32724 - check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or ...
3 years ago

CVE-2022-24731 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write ...
3 years ago

CVE-2022-31034 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to ...
2 years ago

CVE-2022-31102 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the ...
3 years ago

The Limitations of Google Play Integrity API - This overview outlines the history and use of Google Play Integrity API and highlights some limitations. We also compare and contrast Google Play Integrity API with the comprehensive mobile security offered by Approov. Google provides app attestation ...
1 year ago Securityboulevard.com

What happens when you accidentally leak your AWS API keys? - My situation had no ill consequences, but it could have if I had used my actual email for the script or if my project was bigger and I had used AWS or another cloud provider and hardcoded those credentials. In a later class I did learn how to safely ...
1 year ago Isc.sans.edu

CVE-2022-49266 - In the Linux kernel, the following vulnerability has been resolved: ...
6 months ago

API Security: The Big Picture - Given this, it is no surprise that API security is a top priority for many security teams in the coming year. Here are 10 strategic things to look for in an API security offering. Multiple Environment Capability API security isn't very helpful if it ...
1 year ago Darkreading.com

API security in 2024: Predictions and trends - As technology continues to advance at an unprecedented pace, so does the complexity of API security. With the proliferation of APIs in modern applications and services, organizations will need to develop a better understanding of their API ...
1 year ago Helpnetsecurity.com