UpHeron
All vulnerabilities

Servers and applications

CVE-2025-23216

Secret values are not scrubbed from patch errors

Severity
Medium 6.8
Published
30 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.13, 2.12.10, 2.13.4
Also known as
GHSA-47g2-qmh2-749v
Sources
NVD, Project advisories (GitHub)

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing…

Affected software

SoftwareAffected versions
Argo CDServers and applications · cpe:a:argoproj:argo_cd
  • Every version before 2.11.13
  • From 2.12.0 before 2.12.10
  • From 2.13.0 before 2.13.4
Argo CDServers and applications · github:argoproj/argo-cd
  • Every version before 2.11.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-23216
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-23216
  • GitHub Advisory Database https://github.com/advisories/GHSA-47g2-qmh2-749v
  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v