# CVE-2025-55190: Argo CD: Project API Token Exposes Repository Credentials

- Exploited (CISA KEV): no
- Published: 2025-09-04
- CVSS: 10 CRITICAL (v3.1)
- EPSS: 5.7% (93th percentile)
- CWE: CWE-200

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Rule off by default | 2025-09-15 | 11 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-09-15 · new · rule 199cce9ab21e40bcb535f01b2ee2085f · default Disabled
  > Argo CD - Information Disclosure - CVE:CVE-2025-55190s. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-15-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2025-55190, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2025-55190, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-55190 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-55190