NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

Argo CD GitOps Engine does not scrub secret values from patch errorsGHSA-274v-mgcv-cm8j

MEDIUMFix: argoproj/argo-cd@6f5537b

GHSA-274v-mgcv-cm8j is a medium-severity (CVSS 6.8) vulnerability in github.com/argoproj/gitops-engine. A fix is available for github.com/argoproj/gitops-engine — see the affected versions and patch details below.

Also known asGO-2025-3437
Published
Updated
Affected
2 pkgs
Patched
1 / 2
Exploits
None indexed
Exploitation data as of Sep 10, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐹github.com/argoproj/gitops-engine🐹github.com/argoproj/gitops-engine

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.

The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.

Patches

A patch for this vulnerability is available in the following Argo CD versions:

  • v2.13.4
  • v2.12.10
  • v2.11.13

Workarounds

There is no workaround other than upgrading.

Resources

Fixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca

Affected Packages

2 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/argoproj/gitops-engine≥ 0.7.2No fix
🐹Gogithub.com/argoproj/gitops-engineall versions0.7.1-0.20250129155113-4c6e03c463141go get github.com/argoproj/gitops-engine@v0.7.1-0.20250129155113-4c6e03c463141

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/argoproj/gitops-engine, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    A fix is available for GHSA-274v-mgcv-cm8j; check the affected-versions list above or the advisory for the patched release of github.com/argoproj/gitops-engine, then make sure no transitive dependency still pins the vulnerable range.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. ### Patches A patch for this vulnerability is available in the following Argo CD versions: - v2.13.4 - v2.12.10 - v2.11.1
O3 Security · Impact-Aware SCA

Is GHSA-274v-mgcv-cm8j in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Argo CD GitOps Engine does not scrub secret values…