CVE-2025-55190

The vulnerability in Argo CD arises from a flaw in the project details API endpoint, which allows API tokens with project-level permissions to access sensitive repository credentials, including usernames and passwords. This issue is particularly concerning as it enables tokens that should only have application management permissions to retrieve sensitive information without explicit access rights to secrets. The vulnerability affects multiple versions of Argo CD, specifically those ranging from 2.13.0 to 2.13.8, 2.14.0 to 2.14.15, 3.0.0 to 3.0.12, and 3.1.0-rc1 to 3.1.1. The flaw is exacerbated by the fact that any token with project get permissions, including those with global permissions, is also susceptible, thereby broadening the attack surface significantly.

Attack vectors for exploiting this vulnerability are varied and can be executed by any user or service that possesses the affected API tokens. An attacker could leverage a compromised token to query the project details API, thereby obtaining sensitive repository credentials. This could occur in scenarios where an organization has not implemented strict access controls or where API tokens are inadequately managed. For instance, if a developer inadvertently shares their API token or if it is stored insecurely, an attacker could easily exploit this vulnerability to gain unauthorized access to sensitive data. Furthermore, the potential for lateral movement within the organization’s infrastructure increases, as attackers could use the retrieved credentials to access other systems or repositories.

The real-world impact of this vulnerability can be profound, particularly for organizations that rely on Argo CD for continuous delivery in Kubernetes environments. The exposure of sensitive repository credentials can lead to unauthorized access to source code, configuration files, and other critical assets. This not only poses a risk to intellectual property but also increases the likelihood of data breaches, which can result in significant financial losses, reputational damage, and regulatory penalties. The business risk is amplified in industries that are subject to stringent compliance requirements, as the unauthorized disclosure of sensitive information could lead to severe legal ramifications.

To detect and mitigate this vulnerability, organizations should adopt a multi-faceted approach. First, they should ensure that they are running the latest patched versions of Argo CD, as the vulnerability has been addressed in subsequent releases. Regularly auditing API tokens and implementing the principle of least privilege can significantly reduce the risk of exploitation. Organizations should also consider employing monitoring tools that can detect unusual API access patterns or unauthorized attempts to retrieve sensitive information. Additionally, implementing robust logging and alerting mechanisms can help in identifying potential breaches early, allowing for a swift response to any incidents.

In conclusion, the vulnerability in Argo CD presents a serious threat to organizations utilizing this tool for their Kubernetes deployments. The ability for API tokens with limited permissions to access sensitive repository credentials underscores the importance of stringent access controls and vigilant monitoring. By adopting proactive detection and mitigation strategies, organizations can safeguard their assets and reduce the risk associated with this and similar vulnerabilities in the future.

CSURFACE threat intelligence has identified a measurable increase in the Exploit Prediction Scoring System (EPSS) for CVE-2025-55190, reflecting a growing likelihood of exploitation attempts targeting Argo CD deployments. Although no new exploit techniques or proof-of-concept code have surfaced, the upward trend in EPSS—now approaching the 90th percentile—indicates heightened attacker interest and potential preparatory activity. This shift suggests that threat actors may be prioritizing this vulnerability as a vector for unauthorized access to sensitive repository credentials, which could facilitate broader compromise within Kubernetes environments. For defenders, this evolving risk profile underscores the urgency of continuous monitoring and reassessment of access controls around Argo CD projects. The increased EPSS score elevates the threat level from a theoretical risk to a more imminent operational concern, warranting enhanced vigilance despite the absence of confirmed exploitation campaigns at this time.

Update 2 — May 18, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2025-55190, with new telemetry indicating increased attempts to leverage this vulnerability for unauthorized access to sensitive repository credentials within Kubernetes environments. Although no novel exploit techniques or proof-of-concept code have surfaced, the rise in observed activity suggests that threat actors are actively probing or exploiting this weakness, elevating it from a primarily theoretical concern to a more immediate operational threat. This shift underscores a growing adversary focus on compromising Argo CD deployments to gain broader footholds in cloud-native infrastructures. Consequently, the overall risk posture has intensified, warranting heightened monitoring and reassessment of access controls despite the absence of confirmed widespread exploitation campaigns at this time.

Update 3 — July 04, 2026

CSURFACE threat intelligence has identified a marked escalation in probing activity targeting the CVE-2025-55190 vulnerability in Argo CD. While no new exploit code has been publicly disclosed, our telemetry indicates adversaries are increasingly engaging in reconnaissance efforts against affected deployments, suggesting a shift toward active exploitation attempts. This intensification in hostile activity elevates the operational risk, as threat actors may leverage exposed repository credentials to pivot within Kubernetes environments, potentially compromising broader cloud-native infrastructure. The persistence of this vulnerability in widely deployed versions, combined with the rising adversary focus, underscores an urgent need for defenders to reassess detection capabilities and access governance. Although the EPSS score remains stable, the qualitative surge in observed activity signals that the threat landscape is becoming more dynamic and adversaries are prioritizing this vector for initial access or lateral movement.