Is CVE-2026-43824 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43824 being exploited in the wild.

How severe is CVE-2026-43824?

High severity, with a CVSS score of 7.7, published 2 May 2026.

Which products and versions are affected?

Argo Project Argo CD 3.2.0 before 3.2.11, 3.3.0 before 3.3.9.

Is there a fix for CVE-2026-43824?

A patch was published on 2026-05-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43824 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43824?

Check whether you run Argo Project Argo CD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43824: Argo CD information disclosure in ServerSideDiff endpoint

CVE-2026-43824 · Severity: high · CVSS 7.7 · Published 2026-05-02

Argo CD, a popular tool for managing applications on Kubernetes, contains a security flaw that could allow users with limited access to view sensitive information. Specifically, an attacker with read-only permissions can exploit a specific comparison feature to reveal Kubernetes Secrets, such as passwords or API keys, in plain text. This could lead to unauthorized access to other systems or sensitive corporate data managed within the Kubernetes environment.

Technologies: Argo Project Argo CD. Vendors: Argo Project.

Quick answers

Is CVE-2026-43824 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43824 being exploited in the wild.
How severe is CVE-2026-43824?: High severity, with a CVSS score of 7.7, published 2 May 2026.
Which products and versions are affected?: Argo Project Argo CD 3.2.0 before 3.2.11, 3.3.0 before 3.3.9.
Is there a fix for CVE-2026-43824?: A patch was published on 2026-05-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43824 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43824?: Check whether you run Argo Project Argo CD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in the Argo CD ServerSideDiff gRPC/REST endpoint. While Argo CD typically masks Secret data using hideSecretData(), the ServerSideDiff endpoint fails to apply this masking to the PredictedLive and NormalizedLive states in its response. The vulnerability is triggered when an Application has the 'IncludeMutationWebhook=true' annotation, which causes the system to skip the removeWebhookMutation() defense layer that normally strips sensitive fields. An attacker with basic authenticated read-only access can use this endpoint to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. The issue is patched in versions 3.2.11 and 3.3.9.

Affected products

argoproj Argo CD 3.2.0 before 3.2.11, 3.3.0 before 3.3.9
Red Hat Red Hat OpenShift GitOps 1

Timeline

2026-05-01: disclosed
2026-05-01: advisory
2026-05-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.