https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T08:43:15.170784+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5037 EUVD-2026-5037 2026-10-20T08:43:15.175856+00:00 EUVD-2026-5037 https://cve.radiocsirt.org/vuln/fkie_cve-2024-31990 fkie_cve-2024-31990 2026-10-20T08:43:15.175900+00:00

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

 https://cve.radiocsirt.org/vuln/ghsa-2gvw-w6fj-7m3c GHSA-2gvw-w6fj-7m3c — Argo CD's API server does not enforce project sourceNamespaces 2026-10-20T08:43:15.175943+00:00

Affected: Go: github.com/argoproj/argo-cd/v2

### Impact

I can convince the UI to let me do things with an invalid Application. 1. Admin gives me `p, michael, applications, *, demo/*, allow`, where `demo` can just deploy to the `demo` namespace 2. Admin gives me AppProject `dev` which reconciles from ns `dev-apps` 3. Admin gives me `p, michael, applications, sync, dev/*, allow`, i.e. no updating via the UI allowed, gitops-only 4. I create an Application called `pwn` in `dev-apps` with project dev and sync the app with sources from git 5. I change the Application’s project to demo via kubectl or gitops (whichever mechanism my admins have given me, because it should be safe) 6. I use the UI to edit the resource which should only be mutable via gitops

### Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.10.7 v2.9.12 v2.8.16

### For more information If you have any questions or comments about this advisory:

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions) Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

### Credits This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw)

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

 https://cve.radiocsirt.org/vuln/gsd-2024-31990 gsd-2024-31990 2026-10-20T08:43:15.176091+00:00 gsd-2024-31990 https://cve.radiocsirt.org/vuln/rhsa-2024:2816 RHSA-2024:2816 — Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.12.2 security update 2026-10-20T08:43:15.176114+00:00

webpack-dev-middleware: lack of URL validation may lead to file leak argo-cd: API server does not enforce project sourceNamespaces

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1091 WID-SEC-W-2024-1091 — Red Hat OpenShift: Mehrere Schwachstellen 2026-10-20T08:43:15.176145+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen und um die Sicherheitsmaßnahmen zu umgehen.