Argo CD v3.2 and v3.3 prior to 3.2.11 and 3.3.9 contain a missing authorization and data‑masking bug in the ServerSideDiff endpoint; the flaw allows any user with only read‑only access in Argo CD to trigger the Kubernetes API server’s Server‑Side Apply dry‑run feature and obtain plaintext secret values stored in etcd, thereby leaking sensitive passwords, tokens, or keys that could be used for further cluster compromise.

The affected product is Argo CD from argoproj, with vulnerable releases 3.2.0 through 3.2.10 and 3.3.0 through 3.3.8; the issue is fixed in version 3.2.11 and 3.3.9 and later releases.

With a CVSS score of 9.6 this vulnerability is critical in terms of confidentiality impact; the EPSS score is not available, but the lack of proper authorization controls for the endpoint suggests a high probability of exploitation in environments that grant wide read‑only access; the vulnerability is not listed in CISA KEV, indicating no known public exploit yet, yet the potential to exfiltrate sensitive cluster data makes it a high‑risk issue for organizations running the affected releases.