CVE-2023-40025

7.1 highEPSS 0.6%

High (7.1) in argoproj argo cd. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-cd/v2 2.0.0-20230821201509-e047efa8f951, 2.6.14, 2.7.12.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already. A patch for this vulnerability has been released in the following Argo CD versions: 2.6.14, 2.7.12 and 2.8.1.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2023-08-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

argoproj:argo_cd

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-c8xw-vjgf-94hr	Go	github.com/argoproj/argo-cd/v2	>=2.6.0 <2.6.14	2.6.14
GHSA-c8xw-vjgf-94hr	Go	github.com/argoproj/argo-cd/v2	>=2.7.0 <2.7.12	2.7.12
GHSA-c8xw-vjgf-94hr	Go	github.com/argoproj/argo-cd/v2	>=2.8.0 <2.8.1	2.8.1
GHSA-c8xw-vjgf-94hr	Go	github.com/argoproj/argo-cd/v2	>=2.0.0-20230718200744-12a5a7a70d6e <2.0.0-20230821201509-e047efa8f951	2.0.0-20230821201509-e047efa8f951
GO-2023-2018	Go	github.com/argoproj/argo-cd	all versions	no fix published
GO-2023-2018	Go	github.com/argoproj/argo-cd/v2	>=2.6.0 <2.6.14 >=2.7.0 <2.7.12 >=2.8.0 <2.8.1	2.6.14, 2.7.12, 2.8.1

References

Check your stack JSON