CVE-2026-45737: Argo CD information exposure in ServerSideDiff

CVE-2026-45737 · Severity: medium · CVSS 6.3 · Published 2026-07-15

Argo CD, a tool used to automate the deployment of applications to Kubernetes, contains a vulnerability that could expose sensitive information. Under certain conditions, the system's 'diff' feature—which shows changes between intended and actual configurations—may accidentally reveal passwords or other secrets in the user interface or command-line tools. This could allow an attacker with limited access to the system to view confidential credentials, potentially leading to unauthorized access to other services.

Technologies: Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go), github.com/argoproj/argo-cd/v3 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-45737 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45737 being exploited in the wild.
How severe is CVE-2026-45737?
Medium severity, with a CVSS score of 6.3, published 15 July 2026.
Which products and versions are affected?
Argo Project Argo CD >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2, >= 3.2.0, <= 3.2.11; >= 3.3.0-rc1, <= 3.3.9; >= 3.4.0-rc1, <= 3.4.1; github.com/argoproj/argo-cd (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v3 (Go) SEMVER:introduced=3.2.0,fixed=3.2.12, SEMVER:introduced=3.2.0,fixed=3.2.12,introduced=3.3.0-rc1,fixed=3.3.10,introduced=3.4.0-rc1,fixed=3.4.2.
Is there a fix for CVE-2026-45737?
Yes. github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.12, 3.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45737 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45737?
Check whether you run Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.12, 3.4.2 or later
    go get github.com/argoproj/argo-cd/v3@v3.4.2

Technical details

A vulnerability in Argo CD's ServerSideDiff component allows for the exposure of sensitive information from Kubernetes Secrets. The root cause is that the `HideSecretData` function fails to fully sanitize `ResourceDiff.TargetState` and `LiveState` objects, specifically when sensitive data is embedded within the `kubectl.kubernetes.io/last-applied-configuration` annotation. An attacker with low-privileged network access to the Argo CD UI or CLI can view these unsanitized diffs to extract `data`, `stringData`, and sensitive annotations. The issue is fixed by ensuring `HideSecretData` is correctly applied to server-side diff results and removing the last-applied-configuration annotation from comparison states.

Affected products

  • argoproj Argo CD >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2

Identifiers

  • CVE-2026-45737
  • GHSA-rg3g-4rw9-gqrp
  • GO-2026-5618

Timeline

  • 2026-07-15: advisory
  • 2026-07-15: disclosed
  • 2026-05-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.