Max severity Argo CD API flaw leaks repository credentials

Max severity Argo CD API flaw leaks repository credentials

An Argo CD vulnerability allows API tokens with even low project-level get permissions to access API endpoints and retrieve all repository credentials associated with the project.

Critical Argo CD API Vulnerability Exposes Repository Credentials - Cybernoz - Cybersecurity News

A critical vulnerability has been discovered in Argo CD that allows API tokens with limited permissions to access sensitive repository credentials. The flaw in the project details API endpoint exposes usernames and passwords, undermining the platform’s security model by granting access to secrets without explicit permissions. The vulnerability stems from an improper authorization check in the Project API, specifically the /api/v1/projects/{proje…