-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd | go | >= 1.2.0-rc1, <= 1.8.7 | |
| github.com/argoproj/argo-cd/v2 | go | >= 2.9.0, < 2.9.8 | 2.9.8 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.10.0, < 2.10.3 | 2.10.3 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.0.0-rc3, < 2.8.12 | 2.8.12 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation in the application creation flow. The commit diff shows a security patch adding validation to strip the Operation field during creation, with a warning about bypassing branch protection. The original vulnerable code path allowed users to set manifests via the Operation.Sync.Manifests field during application creation without requiring 'override' privileges. The Server.Create function was the entry point for this insecure operation validation.
Ongoing coverage of React2Shell