https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:38:49.382002+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-00882 bdu:2023-00882 2026-10-09T08:38:49.387127+00:00 bdu:2023-00882 https://cve.radiocsirt.org/vuln/euvd-2026-221555 EUVD-2026-221555 2026-10-09T08:38:49.387160+00:00 EUVD-2026-221555 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23947 fkie_cve-2023-23947 2026-10-09T08:38:49.387174+00:00

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters). A patch for this vulnerability has been released in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. Two workarounds are available. Either modify the RBAC configuration to completely revoke all `clusters, update` access, or use the `destinations` and `clusterResourceWhitelist` fields to apply similar restrictions as the `namespaces` and `clusterResources` fields.

 https://cve.radiocsirt.org/vuln/ghsa-3jfq-742w-xg8j GHSA-3jfq-742w-xg8j — Users with any cluster secret update access may update out-of-bounds cluster secrets 2026-10-09T08:38:49.387206+00:00

Affected: Go: github.com/argoproj/argo-cd

### Impact

All Argo CD versions starting with v2.3.0-rc1 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret.

The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters).

#### How the Attack Works

Argo CD stores [cluster access configurations](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters) as Kubernetes Secrets. To take advantage of the vulnerability, an attacker must know the server URL for the cluster secret they want to modify.

The attacker must be authenticated with the Argo CD API server, and they must be authorized to update at least one ([non project-scoped](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters)) cluster. Then they must craft a malicious request to the Argo CD API server.

#### Removing Deployment Restrictions

A cluster Secret's `clusterResources` field determines whether Argo CD users may deploy cluster-scoped resources to that cluster. The `namespaces` field determines the namespaces to which Argo CD users may deploy resources.

You can use this command to determine whether any of your cluster configurations employ these restrictions (replace `argocd` with the namespace of your Argo CD installation):

```shell kubectl get secret…

 https://cve.radiocsirt.org/vuln/gsd-2023-23947 gsd-2023-23947 2026-10-09T08:38:49.387332+00:00 gsd-2023-23947 https://cve.radiocsirt.org/vuln/rhsa-2023:0802 RHSA-2023:0802 — Red Hat Security Advisory: Red Hat OpenShift GitOps security update 2026-10-09T08:38:49.387346+00:00

goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets