CVE-2021-26923

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4Patch, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-pfgj-mh5m-2p48Third Party Advisory
https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4Patch, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-pfgj-mh5m-2p48Third Party Advisory

Timeline

Published: Mar 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-269246.1An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.CVE-2021-269255.4Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.CVE-2021-269267.1A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of inform CVE-2021-269275.5A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of serv CVE-2021-269286.8BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which m CVE-2021-269296.1An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). Th CVE-2021-269307.8An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps gra CVE-2021-269315.5An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a CVE-2021-269325.5An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, w CVE-2021-269335.5An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. Th CVE-2021-269347.8An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_CVE-2021-269357.5In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnera