StackRadar

CVE-2025-55191

Medium

Advisory

Published 30 Sept 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
17
deployed by those charts
Fix available
2 of 3
affected packages

Repository Credentials Race Condition Crashes Argo CD Server

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 17 images.

Affected packageAffected versionsFixed inImages
github.com/argoproj/argo-cd/v2golangv2.4.7, v2.4.11, v2.7.2, v2.7.8+6 more2.14.2012
github.com/argoproj/argo-cd/v3golangv3.0.3, v3.0.5, v3.1.1, v3.1.23.0.19, 3.1.84
github.com/argoproj/argo-cdgolangv1.5.8no fix listed1
OSV records
GHSA-g88p-r42r-ppp9GO-2025-3994
Also known as
BIT-argo-cd-2025-55191

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.1.8

Open the chart page →

5,240
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
2.14.20

Open the chart page →

3,793
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
2.14.20

Open the chart page →

10,315
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.0.19

Open the chart page →

954
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
2.14.20

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
2.14.20

Open the chart page →

1,483
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.0.19

Open the chart page →

10,037
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
2.14.20

Open the chart page →

7,300
capsule-argo-addoncapsule-argo-addonVerified publisher0.7.51 of 2See more

capsule-argo-addon capsule-argo-addon 0.7.5

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
github.com/argoproj/argo-cd/v3@v3.1.2
3.1.8

Open the chart page →

2,038
devtron-in-clustercddevtron0.10.21 of 2See more

devtron-in-clustercd devtron 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
2.14.20

Open the chart page →

5,039
devtron-in-clustercddevtron-labs0.10.21 of 2See more

devtron-in-clustercd devtron-labs 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
2.14.20

Open the chart page →

5,039
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
2.14.20

Open the chart page →

13,450
apid-helpergkarthiks0.1.41 of 1See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
2.14.20

Open the chart page →

2,607
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
2.14.20

Open the chart page →

1,334
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
2.14.20

Open the chart page →

25,934
devtron-in-clustercdromholdings0.10.21 of 2See more

devtron-in-clustercd romholdings 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
2.14.20

Open the chart page →

5,039
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
2.14.20

Open the chart page →

2,620
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
2.14.20

Open the chart page →

2,314
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed

Open the chart page →

6,671
argocd-operatorstatcan0.5.01 of 1See more

argocd-operator statcan 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-55191.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
2.14.20

Open the chart page →

1,985

Container images carrying it

17 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
2.14.20
3
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
2.14.20
2
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
2.14.20
1
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
2.14.20
1
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
2.14.20
1
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
2.14.20
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
2.14.20
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
github.com/argoproj/argo-cd/v3@v3.1.2
3.1.8
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
2.14.20
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.0.19
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.1.8
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
2.14.20
1
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
2.14.20
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.0.19
1
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
2.14.20
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
2.14.20
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.