# CVE-2026-43824: Argo CD information disclosure in ServerSideDiff endpoint

Source: https://junglewise.ai/threats/cve-2026-43824-argo-cd-information-disclosure-in-serversidediff-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43824 · Severity: high · CVSS 7.7 · Published 2026-05-02

Argo CD, a popular tool for managing applications on Kubernetes, contains a security flaw that could allow users with limited access to view sensitive information. Specifically, an attacker with read-only permissions can exploit a specific comparison feature to reveal Kubernetes Secrets, such as passwords or API keys, in plain text. This could lead to unauthorized access to other systems or sensitive corporate data managed within the Kubernetes environment.

Technologies: [Argo Project Argo CD](https://junglewise.ai/threats/technologies/argo-cd). Vendors: [Argo Project](https://junglewise.ai/threats/vendors/argo-project).

## Quick answers

**Is CVE-2026-43824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43824 being exploited in the wild.

**How severe is CVE-2026-43824?** High severity, with a CVSS score of 7.7, published 2 May 2026.

**Which products and versions are affected?** Argo Project Argo CD 3.2.0 before 3.2.11, 3.3.0 before 3.3.9.

**Is there a fix for CVE-2026-43824?** A patch was published on 2026-05-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43824 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43824?** Check whether you run Argo Project Argo CD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the Argo CD ServerSideDiff gRPC/REST endpoint. While Argo CD typically masks Secret data using hideSecretData(), the ServerSideDiff endpoint fails to apply this masking to the PredictedLive and NormalizedLive states in its response. The vulnerability is triggered when an Application has the 'IncludeMutationWebhook=true' annotation, which causes the system to skip the removeWebhookMutation() defense layer that normally strips sensitive fields. An attacker with basic authenticated read-only access can use this endpoint to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. The issue is patched in versions 3.2.11 and 3.3.9.

## Affected products

- argoproj Argo CD 3.2.0 before 3.2.11, 3.3.0 before 3.3.9
- Red Hat Red Hat OpenShift GitOps 1

## Timeline

- 2026-05-01: disclosed
- 2026-05-01: advisory
- 2026-05-01: patched

## References

- [https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3](https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3)
- [https://access.redhat.com/security/cve/CVE-2026-43824](https://access.redhat.com/security/cve/CVE-2026-43824)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2464613](https://bugzilla.redhat.com/show_bug.cgi?id=2464613)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json)

## Related threats

- [Argo CD arbitrary code execution via Helm plugin download in Kustomize](https://junglewise.ai/threats/cve-2026-113709-argo-cd-is-a-declarative-gitops-continuous-delivery-tool-for)
- [Argo CD repo-server command injection via SSH proxy URL](https://junglewise.ai/threats/cve-2026-55797-argo-cd-repo-server-command-injection-via-crafted-ssh-repository)
- [Argo CD stored XSS in application link annotations](https://junglewise.ai/threats/cve-2026-45738-argo-cd-stored-xss-in-application-link-annotations)
- [Argo CD information exposure in ServerSideDiff](https://junglewise.ai/threats/cve-2026-45737-argo-cd-information-exposure-in-serversidediff)
- [Argo CD information disclosure in ServerSideDiff endpoint](https://junglewise.ai/threats/cve-2026-42880-argo-cd-information-disclosure-in-serversidediff-endpoint)