https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 10:04:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-334671 EUVD-2026-334671 https://cve.radiocsirt.org/vuln/euvd-2026-334671 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41354 <p>An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.</p> <p>An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41354 https://cve.radiocsirt.org/vuln/ghsa-2q5c-qw9c-fmvq <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd, Go: github.com/argoproj/argo-cd/v2</p> <p>### Impact</p> <p>All versions of Argo CD starting with v0.5.0 are vulnerable to an information disclosure bug allowing unauthorized users to enumerate application names by inspecting API error messages. An attacker could use the discovered application names as the starting point of another attack. For example, the attacker might use their knowledge of an application name to convince an administrator to grant higher privileges (social engineering).</p> <p>Many Argo CD API endpoints accept an application name as the only parameter. Since Argo CD RBAC requires both the application name and its configured project name (and, if apps-in-any-namespace is enabled, the application&#39;s namespace), Argo CD fetches the requested application before performing the RBAC check. If the application does not exist, the API returns a &#34;not found&#34;. If the application does exist, and the user does not have access, the API returns an &#34;unauthorized&#34; error. By trial and error, an attacker can infer which applications exist and which do not.</p> <p>Note that application resources are not fetched for API calls from _unauthenticated_ users. If your Argo CD instance is accessible from the public internet, unauthenticated users will not be able to cause Argo CD to make Kubernetes API calls.</p> <p>The patch changes API behavior to return &#34;unauthorized&#34; both when the application is missing and when the user is not authorized to access it. **This change in API behavior may impact API clients.** Check your code to make sure it will…</p> <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd, Go: github.com/argoproj/argo-cd/v2</p> <p>### Impact</p> <p>All versions of Argo CD starting with v0.5.0 are vulnerable to an information disclosure bug allowing unauthorized users to enumerate application names by inspecting API error messages. An attacker could use the discovered application names as the starting point of another attack. For example, the attacker might use their knowledge of an application name to convince an administrator to grant higher privileges (social engineering).</p> <p>Many Argo CD API endpoints accept an application name as the only parameter. Since Argo CD RBAC requires both the application name and its configured project name (and, if apps-in-any-namespace is enabled, the application&#39;s namespace), Argo CD fetches the requested application before performing the RBAC check. If the application does not exist, the API returns a &#34;not found&#34;. If the application does exist, and the user does not have access, the API returns an &#34;unauthorized&#34; error. By trial and error, an attacker can infer which applications exist and which do not.</p> <p>Note that application resources are not fetched for API calls from _unauthenticated_ users. If your Argo CD instance is accessible from the public internet, unauthenticated users will not be able to cause Argo CD to make Kubernetes API calls.</p> <p>The patch changes API behavior to return &#34;unauthorized&#34; both when the application is missing and when the user is not authorized to access it. **This change in API behavior may impact API clients.** Check your code to make sure it will…</p> https://cve.radiocsirt.org/vuln/ghsa-2q5c-qw9c-fmvq https://cve.radiocsirt.org/vuln/gsd-2022-41354 gsd-2022-41354 https://cve.radiocsirt.org/vuln/gsd-2022-41354 https://cve.radiocsirt.org/vuln/rhsa-2023:1452 <p>ArgoCD: Authenticated but unauthorized users may enumerate Application names via the API</p> <p>ArgoCD: Authenticated but unauthorized users may enumerate Application names via the API</p> https://cve.radiocsirt.org/vuln/rhsa-2023:1452 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0746 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift GitOps ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift GitOps ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0746