Argo CD Patches Critical CVSS 10 Vulnerability Exposing Repository Credentials (CVE-2025-55190)

Argo CD has disclosed and patched a critical vulnerability (CVE-2025-55190, CVSS 10) that affects its GitOps platform for Kubernetes, exposing repository credentials stored in projects. The flaw resides in the Project API, where tokens with basic project permissions could retrieve repository credentials such as usernames and passwords via the project details API endpoint.

According to the advisory GHSA-786q-9hcg-v9ff, API tokens with project-level permissions can access sensitive data even when they lack explicit access to secrets. The issue centres on the /api/v1/projects/{project}/detailed endpoint, which failed to restrict access to sensitive data, enabling exposure of embedded credentials for repositories linked to a project. The Argo CD team has released patched versions: v3.1.2, v3.0.14, v2.14.16 and v2.13.9, and users are urged to upgrade to the latest release.