{"id":"GO-2025-3934","revision":"cf8566add6554d4f97c10c4d3b446e19","records":[{"revision":"cf8566add6554d4f97c10c4d3b446e19","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3934","aliases":["BIT-argo-cd-2025-55190","CVE-2025-55190","GHSA-786q-9hcg-v9ff"],"title":"Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd","description":"Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd","state":0,"publishedAt":"2025-09-08T14:13:10+00:00","modifiedAt":"2026-02-04T03:32:26.317744+00:00","affected":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.13.0"},{"kind":"fixed","version":"2.13.9"},{"kind":"introduced","version":"2.14.0"},{"kind":"fixed","version":"2.14.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.0.14"},{"kind":"introduced","version":"3.1.0-rc1"},{"kind":"fixed","version":"3.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff","https://nvd.nist.gov/vuln/detail/CVE-2025-55190","https://github.com/argoproj/argo-cd/commit/e8f86101f5378662ae6151ce5c3a76e9141900e8"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3934","license":"OSV · upstream source license applies","key":"osv:GO-2025-3934","identifiers":["GO-2025-3934","BIT-argo-cd-2025-55190","CVE-2025-55190","GHSA-786q-9hcg-v9ff"]},"retained":false,"historicalAffected":[]}],"coverage":[]}