Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

The vulnerability affects argoproj:argo-cd, specifically Argo CD versions from 3.2.0 up to but not including 3.2.12, 3.3.10, and 3.4.2. Versions 3.2.12, 3.3.10, and 3.4.2 contain the fix and are not vulnerable.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of <1% suggests low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated access to the Argo CD server and the ability to trigger ServerSideDiff, typically via the web UI or CLI, which is why the attack vector is inferred to be remote. If the server is publicly exposed or RBAC misconfigured, the risk of exposure increases.