Is github.com/argoproj/argo-cd/v2 safe ? github.com/argoproj/argo-cd/v2 (go) has 46 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 300 direct dependencies
55 carry known advisories, worst CRITICAL
3 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 43rd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-fmxq-cgp8-87wp, the advisory selected below
// 46 advisories GHSA-fmxq-cgp8-87wp Argo CD checks an Application's AppProject before it creates resources during a sync. CRIT GHSA-786q-9hcg-v9ff Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API… CRIT GHSA-2hj5-g64g-fp6p This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes… CRIT GHSA-9766-5277-j5hr By default, the Redis database server is not password-protected. CRIT GHSA-x32m-mvfj-52xv An attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the… CRIT GHSA-jwv5-8mqv-g387 Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can… CRIT GHSA-fwr2-64vr-xv9m Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. CRIT GHSA-h4w9-6x78-8vrj All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript… CRIT GHSA-r642-gv9p-2wjj A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the admin… CRIT GHSA-j6cw-g6p4-7hch Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. HIGH Show all 46 advisories Argo CD checks an Application's AppProject before it creates resources during a sync.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High // questions Is github.com/argoproj/argo-cd/v2 safe to install? CyberXYZ does not call a package safe in absolute terms. It records 46 known vulnerabilities for github.com/argoproj/argo-cd/v2 (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/argoproj/argo-cd/v2 have known vulnerabilities? Yes. CyberXYZ records 46 known vulnerabilities for github.com/argoproj/argo-cd/v2 (go), the worst rated CRITICAL. These include GHSA-fmxq-cgp8-87wp, GHSA-786q-9hcg-v9ff, GHSA-2hj5-g64g-fp6p, GHSA-9766-5277-j5hr, GHSA-x32m-mvfj-52xv.
How do I check github.com/argoproj/argo-cd/v2 before installing? Search github.com/argoproj/argo-cd/v2 in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fargoproj%2Fargo-cd%2Fv2 . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:24 UTC. The most recent advisory here was published 2026-10-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page