Junglewise Threat Intelligence

CVE-2026-45737: Argo CD information exposure in ServerSideDiff

CVE-2026-45737 · Severity: medium · CVSS 6.3 · Published 2026-07-15

Technologies: github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v3 (Go), Argo Project Argo CD, github.com/argoproj/argo-cd/v2 (Go). Vendors: Go, Argo Project.

Executive brief

Argo CD, a tool used to automate the deployment of applications to Kubernetes, contains a vulnerability that could expose sensitive information. Under certain conditions, the system's 'diff' feature—which shows changes between intended and actual configurations—may accidentally reveal passwords or other secrets in the user interface or command-line tools. This could allow an attacker with limited access to the system to view confidential credentials, potentially leading to unauthorized access to other services.

Technical details

A vulnerability in Argo CD's ServerSideDiff component allows for the exposure of sensitive information from Kubernetes Secrets. The root cause is that the `HideSecretData` function fails to fully sanitize `ResourceDiff.TargetState` and `LiveState` objects, specifically when sensitive data is embedded within the `kubectl.kubernetes.io/last-applied-configuration` annotation. An attacker with low-privileged network access to the Argo CD UI or CLI can view these unsanitized diffs to extract `data`, `stringData`, and sensitive annotations. The issue is fixed by ensuring `HideSecretData` is correctly applied to server-side diff results and removing the last-applied-configuration annotation from comparison states.

Affected products

  • argoproj Argo CD >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2

Timeline

  • 2026-07-15: advisory
  • 2026-07-15: disclosed
  • 2026-05-10: patched

References

Related threats