VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/argoproj/argo-cd/v2: vulnerability history, versions and safety

github.com/argoproj/argo-cd/v2 is a package in the Go ecosystem. Vulert records 28 vulnerabilities for it across 120 releases, from May 2021 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
28 vulnerabilities recorded C6 H5 M12 U5
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 15 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/argoproj/argo-cd/v2 vulnerabilities

Vulert verdict on github.com/argoproj/argo-cd/v2 v2.14.21 i

Updated on 23 Oct 2026

Action needed: v2.14.21 has 8 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 83/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v2.14.21 — affected i
  • Vulnerabilities on record 28 over 5 years · 2 in the last year i
  • Latest disclosure 15 Oct 2026 i
  • Highest CVSS 10.0 i
  • With no published fix 2 i
  • Stars 24,435 i
  • OpenSSF scorecard 9/10 i
  • Last release 11 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/argoproj/argo-cd/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.0.0-20251104145645-206a6eeca509 04 Nov 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.21 04 Nov 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.20 30 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.19 22 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.18 18 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.13 08 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.11.14 08 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.10.20 08 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.10.19 08 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.17 04 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.9 04 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.16 04 Sep 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.15 16 Jun 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.14 09 Jun 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.14-0.20250605091630-14fa0e0d9fcf 05 Jun 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.14-0.20250528204038-a2361bf85070 28 May 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.8 28 May 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.13 28 May 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.12 20 May 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.12-0.20250520134913-25235fbc2d7f 20 May 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.11 22 Apr 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.10 14 Apr 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.12 11 Apr 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.7 10 Apr 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.9 02 Apr 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.11 24 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.6 24 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.8 24 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.7 19 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.6 18 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.5 11 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.6-0.20250310151858-17a535f6d42f 10 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.4 04 Mar 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.3 27 Feb 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.2 05 Feb 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.5 05 Feb 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.1 03 Feb 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0 03 Feb 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc7 29 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.11.13 29 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.10 29 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.4 29 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc6 21 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250110080752-1645d576fd0c 10 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250108221727-b8508f29162b 08 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc5 08 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250108152729-2a497ef1fdca 08 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250107224631-06bd2ad10f51 07 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250106194511-c739478b8bb6 06 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250103234423-e66068c11b5a 03 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.3 03 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.9 03 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250103170937-5508d1fedaf5 03 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250102232741-13235ad477e8 02 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250102213326-b6770bdb7985 02 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20250101213553-db8d2f08d926 01 Jan 2025 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241231083411-812650847cfe 31 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241230090258-8bb2119a62db 30 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241230044207-635e592778d1 30 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241226194710-afbde2a930ac 26 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241224035012-f429352c0a22 24 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc4 23 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241222110207-ac8e3f01e943 22 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241221185823-f15e1bc52c5c 21 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241221104455-0b542baacb31 21 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241220170959-26ebb9bb5e07 20 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241219140710-8841b0dd1d94 19 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241219042928-bf2c4e866a85 19 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc3 18 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241218174952-5e30858705d8 18 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241217215118-45e488657bf3 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc2 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241217165600-46bfc10e4d4e 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241217150819-2ac03b515226 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.14.0-rc1 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241217073106-9203dd16af6d 17 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241216233409-1a69663a70cd 16 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241216215909-433b317c358b 16 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241216171811-dc3f40c31e1a 16 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241216004434-4471603de2a8 16 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241214051048-030a7be7e2fd 14 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241213201052-8dbddb101ac8 13 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241212060538-87c853e87291 12 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241211155017-6897c2e33f05 11 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241211145659-9c3b45f5da0b 11 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.12.8 11 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241211145641-dc4312405813 11 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.13.2 11 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241210104443-2f51067e7559 10 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241209211935-dfbfdbab1188 09 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241206154836-96d0226a4963 06 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241205200329-4f6e4088efc7 05 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241204074550-522d07a8d8d5 04 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241203203226-730363f14ba7 03 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241203171555-523b0e6a7846 03 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241203100425-0d7f1f705359 03 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241203020753-205b3d38c74c 03 Dec 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241130203045-91360648d373 30 Nov 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241128192533-02d6866f8a82 28 Nov 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241127111054-fc6105b2bd7d 27 Nov 2024 C2 H1 M3 U2 Apache-2.0 Yes Details →
v2.0.0-20241127042310-36d189c133b2 27 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241126184505-9a14d7f5dddc 26 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241125155346-98688e068676 25 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241125042503-62a84d5747d8 25 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241125010539-6a091023893d 25 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241123192252-ff0864318630 23 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241122112503-32cc6638f78e 22 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241122050815-9f1431e1eb1d 22 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241121150710-c6804e985482 21 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241121044717-3b81d3c072b5 21 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241121044353-c8c22d3d5af6 21 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241121044130-2c2e669247d9 21 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241120195731-fc9b33b32508 20 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241120154952-29ac23827a07 20 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.13.1 20 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241120105703-3da5a3de52c9 20 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241118212349-83953fe27684 18 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241114132336-6d8d32f170c9 14 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241113130438-0f872f51be36 13 Nov 2024 C2 H1 M3 U2 — Yes Details →
v2.0.0-20241112013519-993d79ca27b4 12 Nov 2024 C2 H1 M3 U2 — Yes Details →

The newest 120 of 3,357 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 4
  • 2023 7
  • 2024 10
  • 2025 4
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 28 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/argoproj/argo-cd/v2

The 5 most severe of 28 vulnerabilities recorded for this package

Search all 28 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2022-29165: Argo CD JWT Impersonation Vulnerability 10.0 critical 2.3.4 24 May 2022
CVE-2025-55190: Argo CD API Token Vulnerability Exposes Sensitive Repository Credentials 9.9 critical 2.13.9 04 Sep 2025
CVE-2023-40029: Argo CD Cluster Secret Leakage in Cluster Details Page 9.9 critical 2.6.15 11 Sep 2023
CVE-2026-77459: Argo CD Resource Hook Bypass Vulnerability 9.9 critical No fix published 15 Oct 2026
CVE-2024-21652: Bypassing Brute Force Protection in Argo CD 9.8 critical 2.8.13 18 Mar 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/argoproj/argo-cd/v2

Is github.com/argoproj/argo-cd/v2 safe to use?

Vulert records 28 vulnerabilities for github.com/argoproj/argo-cd/v2 in Go: 6 critical, 5 high, 12 medium and 0 low, plus 5 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/argoproj/argo-cd/v2's Vulert package health score?

Vulert scores github.com/argoproj/argo-cd/v2 83/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/argoproj/argo-cd/v2 affected?

Yes. v2.14.21, the version you would install today, has 8 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/argoproj/argo-cd/v2 have?

28 vulnerabilities are recorded for github.com/argoproj/argo-cd/v2 in the Go ecosystem: 6 critical, 5 high, 12 medium and 0 low, plus 5 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/argoproj/argo-cd/v2 vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/argoproj/argo-cd/v2 in the last 12 months, and the oldest entry in this database dates to 21 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/argoproj/argo-cd/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/argoproj/argo-cd/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/argoproj/argo-cd/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.