Argo CD Project API Token Vulnerability Exposes Sensitive Repository Credentials

A vulnerability exists in Argo CD versions 2.13.0 prior to 2.13.9, 2.14.0 prior to 2.14.16, 3.0.0 prior to 3.0.14, and 3.1.0-rc1 prior to 3.1.2. API tokens with project-level permissions can access sensitive repository credentials, including usernames and passwords, through the project details API endpoint. This occurs even when the token only has standard application management permissions and no explicit access to secrets. The vulnerability also affects any token with project get permissions, including certain global permissions.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive repository credentials, which could be misused to access or manipulate repository contents or configurations.

Reproduction

To reproduce this vulnerability, create an API token with project-level permissions that include 'get' access to the project. Then, call the project details API for the affected project. The response will include sensitive repository credentials associated with the project.

Remediation

Users can upgrade to Argo CD versions 2.13.9, 2.14.16, 3.0.14, or 3.1.2 to address this vulnerability.