CVE-2021-26923 Information disclosure in n/a
Unauthenticated access to the /api/version endpoint in Argo CD leaks internal system information, requiring an upgrade to secure the endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26923?
CVE-2021-26923 is a high-severity vulnerability in Argoproj Argo Cd, published on 15 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.
Weakness: CWE-200
Which versions are affected by CVE-2021-26923?
It affects 1 product.
Products include Argoproj Argo Cd.
How do I fix CVE-2021-26923?
No fix has been published for CVE-2021-26923 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-26923 being exploited?
There is no known exploitation of CVE-2021-26923 in the wild and no public exploit code.
Other vulnerabilities in Argoproj Argo Cd
- CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
- CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled
- CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss
Sources
Also known as GHSA-pfgj-mh5m-2p48.