UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55190

Project API Token Exposes Repository Credentials

Severity
Critical 9.9
Published
4 Sept 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.13.9, 2.14.16, 3.0.14, 3.1.2
Also known as
GHSA-786q-9hcg-v9ff
Sources
NVD, Project advisories (GitHub)

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application…

Affected software

SoftwareAffected versions
Argo CDServers and applications · cpe:a:argoproj:argo_cd
  • From 2.2.0 before 2.13.9
  • From 2.14.0 before 2.14.16
  • From 3.0.0 before 3.0.14
  • From 3.1.0 before 3.1.2
Argo CDServers and applications · github:argoproj/argo-cd
  • From 2.2.0-rc1 before 2.13.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55190
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55190
  • GitHub Advisory Database https://github.com/advisories/GHSA-786q-9hcg-v9ff
  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff