In September 2023, security researchers from KTrust reported three issues through the official Argo CD security disclosure channels in accordance with Argo CD security policy. In coordination with other Argo maintainers, we have issued security updates for both Argo CD and Codefresh GitOps (enterprise Argo). Below you can read more about these CVEs, their impact, and mitigation.

The security and storage of secrets is one of the most controversial subjects when it comes to GitOps deployments. Some teams want to go “by the book” and use Git as the storage medium (in an encrypted form of course) while others accept the fact that secrets must be handled in a different way (outside of GitOps). There is no right or wrong answer here and depending on the organization requirements, either solution might be a great fit.