CVE-2026-45737: 
Argo CD vulnerability analysis and mitigation

CVE-2026-45737 is an information disclosure vulnerability in Argo CD's ServerSideDiff feature that exposes Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. It affects Argo CD versions 3.2.0 through 3.2.11, 3.3.9, and 3.4.1, and is described as an incomplete fix for a prior advisory (GHSA-3v3m-wc6v-x4x3). The vulnerability was published on May 19, 2026, with patches released in versions 3.2.12, 3.3.10, and 3.4.2. It carries a CVSS v3.1 base score of 6.3–6.5 (Medium) depending on the scoring source (GitHub Advisory).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). When Argo CD performs a server-side diff, the serverSideDiff() function calls HideSecretData(target, live, ...), but this function only sanitizes the live argument — not the predictedLive object, which is derived from a Kubernetes server-side dry-run. Because Kubernetes dry-run returns a full predicted live Secret object that carries forward existing live annotations (including kubectl.kubernetes.io/last-applied-configuration), the predictedLive object can contain a JSON-serialized Secret manifest with raw data, stringData, and sensitive annotation values that are never masked before being returned in UI or CLI diff output. The fix removes the kubectl.kubernetes.io/last-applied-configuration annotation from both predictedLive and live objects before comparison, and applies HideSecretData to both sides (GitHub Advisory, Patch Commit).

An authenticated Argo CD user with permission to view application diffs can read plaintext Kubernetes Secret values — including data fields (base64-encoded), stringData fields, and sensitive annotations — that should be masked. This is a confidentiality-only impact with no integrity or availability consequences, but exposed secrets (API keys, passwords, tokens) could enable lateral movement or privilege escalation within the Kubernetes cluster or connected systems. The scope is limited to secrets managed by Argo CD applications where client-side apply was previously used, as those secrets carry the last-applied-configuration annotation (GitHub Advisory).

A proof-of-concept is publicly available in the official GitHub Security Advisory, which includes a complete step-by-step reproduction using a specific Secret manifest, an Argo CD Application configuration, and the exact CLI command to trigger the leak. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.034% (very low probability of exploitation in the near term), and NVD classifies the exploitation status as "poc" with technical impact rated "partial" (GitHub Advisory).

1. Authenticate to Argo CD: Obtain valid Argo CD credentials for an account with at least read access to an application that manages Kubernetes Secrets.
2. Identify a target application: Find an Argo CD application that manages one or more Kubernetes Secrets that were previously created or updated using kubectl apply (client-side apply), which causes the kubectl.kubernetes.io/last-applied-configuration annotation to be stored on the live Secret.
3. Enable ServerSideDiff: Ensure the target application has ServerSideDiff=true configured (either via the argocd.argoproj.io/compare-options annotation or globally), or use the --server-side-diff flag in the CLI.
4. Trigger the diff: Run argocd app diff <app-name> --server-side-diff --exit-code=false via the CLI, or navigate to the application diff view in the Argo CD UI.
5. Extract secret values: Inspect the diff output — the kubectl.kubernetes.io/last-applied-configuration annotation on the predictedLive side will contain a JSON-serialized Secret manifest with unmasked data (base64-encoded), stringData, and annotation values, revealing the raw secret content (GitHub Advisory).

• Logs: Argo CD API server logs showing repeated calls to the ResourceDiff or app diff endpoints with serverSideDiff=true parameters from unexpected users or service accounts; audit logs showing unusual access to application diff views for Secret-containing applications.
• Network: Unusual or high-frequency requests to the Argo CD API server's diff endpoints from internal users or automated scripts not associated with normal CI/CD pipelines.
• Behavioral: Authenticated users or service accounts querying diffs for applications they do not normally interact with, particularly applications managing Secrets in sensitive namespaces.

Upgrade Argo CD to a patched version: 3.2.12, 3.3.10, or 3.4.2 depending on your current release branch. The fix removes the kubectl.kubernetes.io/last-applied-configuration annotation from both predictedLive and live objects before diff comparison, and applies HideSecretData symmetrically to both sides for core/v1 Secrets. If immediate patching is not possible, restrict access to the Argo CD UI and CLI to only trusted users with a legitimate need to view application diffs, and audit which users have access to applications managing Kubernetes Secrets (GitHub Advisory, Patch Commit).