Inclusion of Sensitive Information in Log Files in Argo CD - #VU129010
Published: March 8, 2021 / Updated: May 2, 2026
Vulnerability identifier: #VU129010
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive credentials.
The vulnerability exists due to insertion of sensitive information into log files in Argo CD logging when connecting to an authenticated Helm OCI repository. A local user can read pod logs or aggregated log data to disclose sensitive credentials.
User interaction is required.
Affected software
Argo CD
Remediation
Install security update from vendor's website.
Argo CD - addressed in versions 1.7.14, 1.8.7