Snyk test report

Improper Authentication

critical severity

Exploit: Not Defined

Manifest file: quay.io/argoproj/argocd:v3.4.4/argoproj/argo-cd/v3 › /usr/local/bin/argocd
Package Manager: golang
Vulnerable module: golang.org/x/net/idna
Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/idna@v0.52.0

Detailed paths

Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/idna@v0.52.0
Introduced through: go-distribution@command-line-arguments@* › golang.org/x/net/idna@v0.38.0
Introduced through: helm.sh/helm/v3@* › golang.org/x/net/idna@v0.47.0

Overview

Affected versions of this package are vulnerable to Improper Authentication via the ToASCII and ToUnicode functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.

Note: The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.

Remediation

Upgrade golang.org/x/net/idna to version 0.54.0 or higher.

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Improper Authentication

Detailed paths

Overview

Remediation

References

Infinite loop

Detailed paths

Overview

Remediation

References

Improper Check for Certificate Revocation

Detailed paths

Overview

Remediation

References

Incorrect Type Conversion or Cast

Detailed paths

Overview

Remediation

References

Missing Release of Resource after Effective Lifetime

Detailed paths

Overview

Remediation

References

Improper Authentication

Detailed paths

Overview

Remediation

References

Incorrect Type Conversion or Cast

Detailed paths

Overview

Remediation

References

Uncaught Exception

Detailed paths

Overview

Remediation

References

Allocation of Resources Without Limits or Throttling

Detailed paths

Overview

Remediation

References

Insufficiently Protected Credentials

Detailed paths

Overview

Remediation

References

Incorrect Behavior Order: Validate Before Canonicalize

Detailed paths

Overview

Remediation

References

Authentication Bypass

Detailed paths

NVD Description

Remediation

References

Time-of-check Time-of-use (TOCTOU)

Detailed paths

NVD Description

Remediation

References

Directory Traversal

Detailed paths

NVD Description

Remediation

References

Unrestricted Upload of File with Dangerous Type

Detailed paths

NVD Description

Remediation

References

CVE-2026-35354

Detailed paths

NVD Description

Remediation

References