CVE-2026-45737

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Published Jul 15, 2026 CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Analysis

Technical impact

Affected Systems

The vulnerability affects argoproj:argo-cd, specifically Argo CD versions from 3.2.0 up to but not including 3.2.12, 3.3.10, and 3.4.2. Versions 3.2.12, 3.3.10, and 3.4.2 contain the fix and are not vulnerable.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of <1% suggests low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated access to the Argo CD server and the ability to trigger ServerSideDiff, typically via the web UI or CLI, which is why the attack vector is inferred to be remote. If the server is publicly exposed or RBAC misconfigured, the risk of exposure increases.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

argoproj

argo-cd

affected

Version	Status	Constraints
`>= 3.2.0, < 3.2.12`	affected	—
`>= 3.3.9, < 3.3.10`	affected	—
`>= 3.4.1, < 3.4.2`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:argoproj:argo_cd::::::::

No data.

Vendor Product Versions

Argoproj

Argo-cd

Version	Status	Scheme	Platform
`[3.2.0,3.2.12)`	affected	semver	—
`[3.3.9,3.3.10)`	affected	semver	—
`[3.4.1,3.4.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Argo CD to version 3.2.12, 3.3.10, 3.4.2 or later to apply the vendor patch.
Restrict external access to the Argo CD web UI and CLI to trusted users, and enforce least‑privilege RBAC rules so that only authorized personnel can request ServerSideDiff operations.
Review and cleanse any kubectl.kubernetes.io/last-applied-configuration annotations on Secret objects before applying or displaying them, and monitor for unauthorized diff requests in logs.

Generated by OpenCVE AI on July 31, 2026 at 02:52 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rg3g-4rw9-gqrp	Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.521% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658
https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0
https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6
https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c
https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp

History

Jul 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 12:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Argoproj Argoproj argo-cd
Vendors & Products		Argoproj Argoproj argo-cd

Jul 15, 2026 8:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Title		Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Weaknesses		CWE-200 CWE-212
References		https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658 https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0 https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6 https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c https://github.com/argoproj/argo-cd/releases/tag/v3.2.12 https://github.com/argoproj/argo-cd/releases/tag/v3.3.10 https://github.com/argoproj/argo-cd/releases/tag/v3.4.2 https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}`