CVE-2026-43824: 
Argo CD vulnerability analysis and mitigation

CVE-2026-43824 is an information disclosure vulnerability in Argo CD's ServerSideDiff feature that allows low-privileged authenticated users to read cleartext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. It affects Argo CD versions 3.2.0 through 3.2.10 and 3.3.0 through 3.3.8. The vulnerability was published on May 2, 2026, with patches available in versions 3.2.11 and 3.3.9. It carries a CVSS v3.1 base score of 7.7 (High) per NVD, though the upstream security advisory (GHSA-3v3m-wc6v-x4x3) rates it 9.6 (Critical) due to additional integrity impact (Github Advisory, Argo CD Advisory).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). All other Argo CD endpoints that return Kubernetes resource state — such as GetManifests, GetResource, and PatchResource — apply the hideSecretData() function to mask secret values, but the ServerSideDiff gRPC/REST endpoint (/application.ApplicationService/ServerSideDiff) constructs its response using raw, unmasked PredictedLive and NormalizedLive states. Argo CD includes a defense mechanism (removeWebhookMutation()) that strips non-Argo-CD-managed fields from the Server-Side Apply dry-run response, but this defense is entirely bypassed when an Application has the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true. For exploitation to succeed, the target Secret's data fields must be owned by at least one non-Argo CD SSA field manager (e.g., kube-controller-manager), so that the real values survive the dry-run response. A public proof-of-concept Python script is included in the upstream advisory (Argo CD Advisory).

An attacker with only read-only (low-privilege) Argo CD access can extract plaintext Kubernetes Secret data including service account tokens, TLS certificates, database credentials, and API keys stored in etcd. The scope is marked as Changed, meaning the vulnerability can affect resources beyond the Argo CD component itself — potentially exposing secrets across all namespaces managed by the affected Argo CD application. This could enable lateral movement into connected systems, privilege escalation via stolen service account tokens, or full compromise of downstream infrastructure (Argo CD Advisory, Github Advisory).

A public proof-of-concept Python script is included in the upstream security advisory (GHSA-3v3m-wc6v-x4x3), demonstrating automated extraction of Kubernetes Secret values via the vulnerable gRPC endpoint. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (3rd percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog as of the time of this report (Github Advisory, Argo CD Advisory).

1. Reconnaissance: Identify Argo CD instances running versions 3.2.0–3.2.10 or 3.3.0–3.3.8 that are network-accessible. Obtain or possess a valid Argo CD authentication token with at least read-only (get) access to an application.
2. Enumerate managed resources: Send an authenticated GET request to /api/v1/applications/{app-name}/managed-resources to list all Kubernetes resources managed by the target application, filtering for resources of kind Secret.
3. Identify exploitable Secrets: Check whether target Secrets have field managers other than argocd-controller (e.g., kube-controller-manager), as these retain real values in the SSA dry-run response. Also check if the Application has the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true, which bypasses the removeWebhookMutation() defense entirely.
4. Craft and send the gRPC request: Using the PoC script or a custom gRPC-web client, send a POST request to /application.ApplicationService/ServerSideDiff with a minimal target manifest for the Secret (omitting the data field) and the application name and project encoded in the protobuf payload.
5. Extract cleartext Secret data: Parse the gRPC response and decode the targetState (PredictedLive) field, which contains the raw Kubernetes SSA dry-run response with unmasked base64-encoded Secret values. Decode the base64 values to obtain plaintext credentials, tokens, or certificates (Argo CD Advisory).

• Network: Unusual or repeated POST requests to /application.ApplicationService/ServerSideDiff with Content-Type: application/grpc-web+proto from unexpected source IPs or user accounts; high-frequency calls to this endpoint from a single low-privileged user.
• Logs: Argo CD API server logs showing ServerSideDiff calls for multiple applications or namespaces in rapid succession from a single authenticated user; access log entries for /api/v1/applications/{app}/managed-resources followed immediately by gRPC calls to ServerSideDiff.
• Behavioral: A low-privileged Argo CD user account querying ServerSideDiff for applications they do not normally interact with; enumeration of all managed resources across multiple applications in a short time window (Argo CD Advisory).

Upgrade Argo CD to version 3.2.11 or later (for the 3.2.x branch) or 3.3.9 or later (for the 3.3.x branch), which apply proper secret masking to the ServerSideDiff endpoint. As an interim measure, review all Argo CD Applications for the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true and remove it where not strictly required, as this annotation bypasses the existing defense layer. Additionally, implement network-level access controls to restrict access to Argo CD APIs, apply the principle of least privilege to limit user permissions, and rotate any Kubernetes Secrets that may have been exposed. Review Argo CD access logs for anomalous ServerSideDiff usage (Argo CD Advisory, Github Advisory).

The vulnerability received coverage from cybersecurity news outlets including Cybersecurity News and The Daily Tech Feed, highlighting the risk of Kubernetes Secret extraction via the Argo CD ServerSideDiff feature. The Hacker News weekly recap also referenced the vulnerability in the context of notable security events. Social media discussion was observed on Bluesky and Mastodon, with automated CVE notification accounts amplifying the disclosure. The vulnerability was credited to researcher hoang-prod in the upstream advisory (Argo CD Advisory, Cybersecurity News).