Snyk test report

Improper Authentication

critical severity

Exploit: Not Defined

Manifest file: quay.io/argoproj/argocd:v3.5.0-rc1 › /usr/local/bin/git-lfs
Package Manager: golang
Vulnerable module: golang.org/x/net/idna
Introduced through: go-distribution@command-line-arguments@* and golang.org/x/net/idna@v0.38.0

Detailed paths

Introduced through: go-distribution@command-line-arguments@* › golang.org/x/net/idna@v0.38.0

Overview

Affected versions of this package are vulnerable to Improper Authentication via the ToASCII and ToUnicode functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.

Note: The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.

Remediation

Upgrade golang.org/x/net/idna to version 0.54.0 or higher.

Improper Authentication

Detailed paths

Overview

Remediation

References

Infinite loop

Detailed paths

Overview

Remediation

References

GPL-3.0 license

Detailed paths

Time-of-check Time-of-use (TOCTOU)

Detailed paths

NVD Description

Remediation

References

Authentication Bypass

Detailed paths

NVD Description

Remediation

References

Directory Traversal

Detailed paths

NVD Description

Remediation

References

Unrestricted Upload of File with Dangerous Type

Detailed paths

NVD Description

Remediation

References

CVE-2026-35350

Detailed paths

NVD Description

Remediation

References

CVE-2026-35357

Detailed paths

NVD Description

Remediation

References

CVE-2026-35374

Detailed paths

NVD Description

Remediation

References

CVE-2026-35373

Detailed paths

NVD Description

Remediation

References

CVE-2026-35370

Detailed paths

NVD Description

Remediation

References

CVE-2026-35341

Detailed paths

NVD Description

Remediation

References

CVE-2026-35367

Detailed paths

NVD Description

Remediation

References

CVE-2026-35368

Detailed paths

NVD Description

Remediation

References

CVE-2026-35354

Detailed paths

NVD Description

Remediation

References

CVE-2026-35348

Detailed paths

NVD Description