CVE-2026-45737

Analyzed Analyzed - Analysis Complete

Information Disclosure in Argo CD ServerSideDiff

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45737

Affected Vendors & Products

Vendor	Product	Version / Range
argoproj	argo_cd	From 3.2.0 (inc) to 3.2.12 (exc)
argoproj	argo_cd	From 3.3.9 (inc) to 3.3.10 (exc)
argoproj	argo_cd	From 3.4.1 (inc) to 3.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-212	The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Argo CD (CVE-2026-45737) allows exposure of Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. The ServerSideDiff feature fails to fully sanitize ResourceDiff.TargetState and LiveState, revealing sensitive data in UI or CLI diffs for versions 3.2.0 to 3.2.11, 3.3.9, and 3.4.1.

Detection Guidance

To detect this vulnerability, check if your Argo CD version is between 3.2.0-3.2.11, 3.3.0-3.3.9, or 3.4.0-3.4.1. Use kubectl get deployments -n argocd -l app.kubernetes.io/name=argocd-server to find the Argo CD server pod. Then run kubectl logs <argocd-server-pod> -n argocd | grep -i secret to inspect logs for exposed secret data in diffs.

Impact Analysis

Authenticated Argo CD users with access to application diffs could potentially read masked Secret values. This may lead to unauthorized exposure of sensitive Kubernetes Secret data, including raw values, stringData, and annotations stored in the last-applied-configuration annotation.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive personal or health data (GDPR/HIPAA). Unauthorized access to Secrets may result in data breaches, leading to legal penalties, reputational damage, and failure to meet regulatory standards for data protection and confidentiality.

Mitigation Strategies

Upgrade Argo CD to versions 3.2.12, 3.3.10, or 3.4.2 immediately. If upgrading is not possible, disable the ServerSideDiff feature by setting server.sideDiff.enabled=false in the Argo CD ConfigMap. Restrict access to Argo CD diff views to minimize exposure.

Hi! I’m here to help you understand CVE-2026-45737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70