CVE-2025-55190
CRITICALCVSS v3
9.9
CRITICAL
EPSS Score
14.8%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.
Technical Details
- Published
- 9/4/2025
Frequently Asked Questions
What is CVE-2025-55190?
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.
Is CVE-2025-55190 actively exploited?
Active exploitation of CVE-2025-55190 has not been confirmed. The EPSS score is 14.8%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-55190?
CVE-2025-55190 has a CVSS v3 base score of 9.9 (CRITICAL severity).
Is CVE-2025-55190 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.