GHSA-274v-mgcv-cm8j is a medium-severity (CVSS 6.8) vulnerability in github.com/argoproj/gitops-engine. A fix is available for github.com/argoproj/gitops-engine — see the affected versions and patch details below.
Argo CD GitOps Engine does not scrub secret values from patch errors
Real-World Exposure
github.com/argoproj/gitops-engine🐹github.com/argoproj/gitops-engineReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.
The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.
Patches
A patch for this vulnerability is available in the following Argo CD versions:
- v2.13.4
- v2.12.10
- v2.11.13
Workarounds
There is no workaround other than upgrading.
Resources
Fixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/argoproj/gitops-engine | ≥ 0.7.2 | No fix |
| 🐹Go | github.com/argoproj/gitops-engine | all versions | 0.7.1-0.20250129155113-4c6e03c463141go get github.com/argoproj/gitops-engine@v0.7.1-0.20250129155113-4c6e03c463141 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/argoproj/gitops-engine, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
No patched version of github.com/argoproj/gitops-engine has shipped for GHSA-274v-mgcv-cm8j yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-274v-mgcv-cm8j can be triaged on real exposure rather than presence alone.
Tailored to GHSA-274v-mgcv-cm8j. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-274v-mgcv-cm8j in your dependencies?
O3 Security finds GHSA-274v-mgcv-cm8j across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.