Introduction
An attacker who obtains a project-level API token in Argo CD can extract repository credentials, including usernames and passwords, even when the token was never meant to access secrets. The flaw affects a wide range of Argo CD deployments and puts private Git repositories and Kubernetes application pipelines at risk of compromise.
Argo CD is an open source GitOps continuous delivery tool for Kubernetes, maintained under the CNCF. Enterprise and cloud-native teams widely use it to manage application deployments through declarative Git workflows. Because it controls access to infrastructure and code repositories, its security is critical.
Technical Information
CVE-2025-55190 comes from insufficient access control in the project details API endpoint of Argo CD. API tokens with project-level permissions, or with global project get permissions (such as p, role/user, projects, get, *, allow), can retrieve repository credentials. These include the usernames and passwords used to authenticate to private Git repositories.
The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The API endpoint does not filter or restrict credential data in its responses, even for tokens that have no explicit secret access. Any token with project get permissions can therefore read repository authentication details through the project details API.
Affected versions include 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12, and 3.1.0-rc1 through 3.1.1. An attacker holding one of these tokens can escalate privileges, read private code, and potentially compromise the CI/CD pipelines or Kubernetes clusters that Argo CD manages.
Affected Systems and Versions
- Argo CD versions 2.13.0 through 2.13.8
- Argo CD versions 2.14.0 through 2.14.15
- Argo CD versions 3.0.0 through 3.0.12
- Argo CD versions 3.1.0-rc1 through 3.1.1
Any configuration where API tokens have project get permissions is vulnerable, including tokens with global project read access.
Vendor Security History
Argo CD has had several critical vulnerabilities in recent years, including:
- CVE-2024-31989: Privilege escalation via Redis cache manipulation
- CVE-2025-47933: Cross-site scripting in the UI
The Argo CD team typically responds quickly with patches and advisories. Severe vulnerabilities turn up often enough that Argo CD environments need prompt patching and strong RBAC practices.
