https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T14:29:13.824404+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2024-05984 bdu:2024-05984 2026-10-02T14:29:13.882743+00:00 bdu:2024-05984 https://vulnerability.circl.lu/vuln/fkie_cve-2024-37152 fkie_cve-2024-37152 2026-10-02T14:29:13.882815+00:00

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

 https://vulnerability.circl.lu/vuln/ghsa-87p9-x75h-p4j2 GHSA-87p9-x75h-p4j2 — Unauthenticated Access to sensitive settings in Argo CD 2026-10-02T14:29:13.882875+00:00

Affected: Go: github.com/argoproj/argo-cd/v2/server

# Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.

# Details ## **Unauthenticated Access:**

### Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`.

Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.3 v2.10.12 v2.9.17

# Impact ## Unauthenticated Access:

* Type: Unauthorized Information Disclosure. * Affected Parties: All users and administrators of the Argo CD instance. * Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.