EUVD-2025-26875Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to ret…

Exact source revision recorded 27 Oct 2026 22:54:40 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

euvd · EUVD-2025-26875

Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 4, 2025, 10:37:52 PM

dateUpdated: Sep 5, 2025, 4:07:25 PM

8 related source bulletins · separate from aliases

RHSA-2025:15389: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

CVE-2025-55190

RHSA-2025:15387: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

CVE-2025-55190

WID-SEC-W-2025-1978: Red Hat OpenShift GitOps (Argo CD): Schwachstelle ermöglicht Offenlegung von Informationen

CVE-2025-55190

RHSA-2025:15388: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

CVE-2025-55190

RHSA-2026:1017: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.3 security update

CVE-2025-13888 · CVE-2025-47913 · CVE-2025-55190 · CVE-2025-58183 · CVE-2025-61729 · CVE-2025-68156

RHSA-2026:1488: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.1 security update

CVE-2025-55190 · CVE-2025-58183

openSUSE-SU-2025:15538-1: govulncheck-vulndb-0.0.20250908T141310-1.1 on GA media

CVE-2024-52284 · CVE-2024-58259 · CVE-2025-51667 · CVE-2025-53884 · CVE-2025-54467 · CVE-2025-55190 · CVE-2025-56760 · CVE-2025-56761 · CVE-2025-58355 · CVE-2025-6203 · CVE-2025-8077 · CVE-2025-9566

RHSA-2026:1018: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update

CVE-2025-47913 · CVE-2025-55190 · CVE-2025-58183 · CVE-2025-58754 · CVE-2025-61729 · CVE-2025-68156

Source published: Sep 4, 2025, 10:37:52 PM (timezone not stated)
Source modified: Sep 5, 2025, 4:07:25 PM (timezone not stated)
Observed here: 27 Oct 2026 22:54:40 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 10.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H