CVE-2025-55190

{
  "id": "CVE-2025-55190",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-04T23:15:32.400",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2."
    },
    {
      "lang": "es",
      "value": "Argo CD es una herramienta de entrega continua declarativa, GitOps para Kubernetes. En las versiones 2.13.0 a 2.13.8, 2.14.0 a 2.14.15, 3.0.0 a 3.0.12 y 3.1.0-rc1 a 3.1.1, los tokens de API con permisos a nivel de proyecto pueden recuperar credenciales de repositorio sensibles (nombres de usuario, contraseñas) a través del endpoint de API de detalles del proyecto, incluso cuando el token solo tiene permisos estándar de gestión de aplicaciones y ningún acceso explícito a secretos. Esta vulnerabilidad no solo afecta a los permisos a nivel de proyecto. Cualquier token con permisos de obtención de proyecto también es vulnerable, incluyendo permisos globales como: 'p, role/user, projects, get, *, allow'. Este problema está solucionado en las versiones 2.13.9, 2.14.16, 3.0.14 y 3.1.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "argoproj",
          "product": "argo-cd",
          "versions": [
            {
              "version": ">= 2.13.0, < 2.13.9",
              "status": "affected"
            },
            {
              "version": ">= 2.14.0, < 2.14.16",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0, < 3.0.14",
              "status": "affected"
            },
            {
              "version": ">= 3.1.0-rc1, < 3.1.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-05T16:07:11.324151Z",
          "id": "CVE-2025-55190",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.2.0",
              "versionEndExcluding": "2.13.9",
              "matchCriteriaId": "509DC36B-0F94-49A8-9FCC-759608EE674A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.14.0",
              "versionEndExcluding": "2.14.16",
              "matchCriteriaId": "94CAAB98-4756-4D4C-9D65-6AC761182AF2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndExcluding": "3.0.14",
              "matchCriteriaId": "F787DAD3-5CDA-437F-9234-730303893260"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.1.0",
              "versionEndExcluding": "3.1.2",
              "matchCriteriaId": "EF17F8A2-1829-49D6-BD12-D608DA1A6EB0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/argoproj/argo-cd/commit/e8f86101f5378662ae6151ce5c3a76e9141900e8",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}