en
Argo is a CNCF graduated open-source project for Kubernetes-native application delivery and automation. It is maintained by a global open-source community and provides tools for workflows, GitOps continuous delivery, event processing, and progressive deployment.
As of 10/22/2026, argoproj recorded 7 security vulnerabilities in the last 90 days across 3 products, including 7 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, argo-cd had the most security vulnerabilities in the argoproj ecosystem, with 5 vulnerabilities—approximately 71.43% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-113709Argo CD: A Kustomize Helm config home can run commands in the repo-serverCVE-2026-113708Argo CD: A Kustomize remote ref can run commands in the repo-serverCVE-2026-113672Argo CD: A Jsonnet import can read files from the repo-serverCVE-2026-77459Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksCVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL88 Results | Page 1 of 9
| SeverityCritical |
| SeverityCritical |
| SeverityCritical |
| SeverityHigh |
| SeverityHigh |
| SeverityCritical |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |