Argo CD Low-Privilege API Token Git Credential Exfiltration (CVE-2025-55190)

Ethan Andrews@eandrews

•updated Jul 1, 2026•14•0•14

Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.