CVE-2023-40025: argoproj argo cd

csirt@kutim:~/threat-intel/cve/CVE-2023-40025

CVSS 7.1 · High EPSS 0,58%

Kerentanan Insufficient Session Expiration pada argoproj argo cd. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already. A patch for this vulnerability has been released in the following Argo CD versions: 2.6.14, 2.7.12 and 2.8.1.

Rincian

Terbit di NVD: 23 Agustus 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-613: Insufficient Session Expiration
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 45,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
argoproj	argo cd	Versi 2.6.0 hingga 2.6.13
argoproj	argo cd	Versi 2.7.11
argoproj	argo cd	Versi 2.8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/argoproj/argo-cd/security/advisories/GHSA-c8xw-vjgf-94hr exploit · advisory vendor
https://github.com/argoproj/argo-cd/commit/e047efa8f9518c54d00d2e4493b64bc4dba98478 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.