In Argo CD versions 3.2.0 prior to 3.2.11 and 3.3.0 prior to 3.3.9, the ServerSideDiff feature can be exploited to read cleartext Kubernetes Secret data. This flaw allows an authenticated user to retrieve confidential credentials and configuration stored in Kubernetes Secrets through the Argo CD interface, thereby compromising the confidentiality of sensitive application data.

The vulnerability affects the Argo CD software from argoproj. All installations running Argo CD versions earlier than 3.2.11 or 3.3.9 are impacted. Users of older minor releases must update to the first patched revision to eliminate the flaw.

The CVSS score of 7.7 indicates a high severity risk. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, so the likelihood of exploitation is uncertain, although the potential impact is significant. The attack vector is likely through the Argo CD web interface by a user with sufficient permissions to trigger ServerSideDiff operations. Successful exploitation results in unauthorized disclosure of sensitive information rather than code execution or denial of service.