Back to Database
Status published
Medium
CVE-2018-21034
In Argo versions prior to v1.5.0-rc1, it was possible for...
Vulnerability Description
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-21034
Credits & Attribution
No credits recorded in the NVD database.
References
More from argoproj
View All →CVE-2025-66626
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
High
8.1
CVE-2025-62157
Argo Workflows exposes artifact repository credentials in workflow-controller logs
High
8.5
CVE-2025-62156
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
High
8.1
CVE-2025-59538
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
High
7.5
CVE-2025-59537
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
High
7.5
Affected Vendor
argoproj
View all reports →Affected Software
argo cd
Vulnerable Versions:
0
Timeline
Official Publish:
April 9th, 2020
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.