Listen to this Post
How CVE-2026-45737 Works
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability resides in the ServerSideDiff endpoint, which is used to compute and display differences between the desired state (Git) and the live state (cluster) of an application.
When Argo CD processes a diff for a Kubernetes Secret, it leverages the Kubernetes API server’s Server-Side Apply (SSA) dry-run mechanism. This dry-run returns a predicted live state of the resource. For Secrets, this predicted live state can contain sensitive data in plaintext if the Secret was originally created or updated using client-side apply. In such cases, the `kubectl.kubernetes.io/last-applied-configuration` annotation is populated with a JSON-serialized manifest that includes the Secret’s data, stringData, and other sensitive annotations.
Argo CD has a function called `HideSecretData(target, live, …)` that is supposed to mask Secret values in API responses. However, in the ServerSideDiff endpoint, this function does not fully sanitize the `ResourceDiff.TargetState` and `LiveState` fields. Specifically, it only masks the top-level Secret data but fails to scrub the `last-applied-configuration` annotation, which may still contain the raw sensitive information. This incomplete sanitization allows the plaintext Secret values to be exposed in both the UI and CLI diff outputs.
The issue is exacerbated by the fact that Argo CD’s default RBAC policy grants authenticated users `get` access to this endpoint, meaning any user with basic access can potentially trigger the diff and view the exposed Secrets. Furthermore, when the application annotation `argocd.argoproj.io/compare-options: IncludeMutationWebhook=true` is set, the defense mechanism that normally strips non-Argo CD-managed fields is bypassed, allowing the raw SSA dry-run response—which contains real Secret values—to flow directly into the API response.
The vulnerability affects Argo CD versions from 3.2.0 up to (but not including) 3.2.12, 3.3.10, and 3.4.2. It is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
DailyCVE Form:
Platform: Argo CD
Version: 3.2.0-3.2.11, 3.3.0-3.3.9, 3.4.0-3.4.1
Vulnerability: Secret exposure via ServerSideDiff
Severity: Medium (CVSS 6.3)
Date: 2026-07-15
Prediction: Patch expected 2026-05-19
What Undercode Say:
Analytics:
- Attack Vector: Network (AV:N)
- Attack Complexity: High (AC:H) – requires specific conditions (client-side apply, annotation presence)
- Privileges Required: Low (PR:L) – any authenticated Argo CD user
- User Interaction: None (UI:N)
- Scope: Changed (S:C) – impacts resources beyond the vulnerable component
- Confidentiality Impact: High (C:H) – plaintext Secret exposure
- Integrity Impact: None (I:N)
- Availability Impact: None (A:N)
- CVSS v3.1 Score: 6.3 (Medium)
- Exploit Price Estimate: $0–$5k
- Public Exploit: None available
Bash Commands & Codes:
To check if your Argo CD version is vulnerable:
argocd version --client
or
kubectl get deployment argocd-server -n argocd -o jsonpath='{.spec.template.spec.containers[bash].image}'
To reproduce the vulnerability (requires authenticated access):
argocd app diff <APPLICATION_NAME> --server-side-diff
To check for the presence of the vulnerable annotation in a Secret:
kubectl get secret <SECRET_NAME> -o jsonpath='{.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration}' | jq .
Exploit:
An attacker with authenticated read-only access to Argo CD can invoke the ServerSideDiff endpoint on an Application that references a Secret. If the Secret was created or updated using client-side apply (e.g., kubectl apply -f secret.yaml), the `last-applied-configuration` annotation will contain the raw Secret data. The ServerSideDiff response will include this annotation in the diff output, exposing the sensitive values in plaintext. The attack requires no user interaction and can be performed remotely. Additionally, if the Application has the `IncludeMutationWebhook=true` annotation, the built-in defense that strips non-Argo CD fields is bypassed, making the exploitation even more straightforward.
Protection:
- Upgrade Argo CD to the patched versions: 3.2.12, 3.3.10, or 3.4.2 or later.
- Avoid using client-side apply for Kubernetes Secrets. Use server-side apply (
kubectl apply --server-side=true) or manage Secrets through Helm, Kustomize, or external secrets management tools to prevent the `last-applied-configuration` annotation from containing sensitive data. - Review and restrict RBAC permissions for the ServerSideDiff endpoint. Ensure that only trusted users have access to view application diffs.
- Audit logs for any unauthorized or suspicious use of the `argocd app diff –server-side-diff` command.
- Remove the `IncludeMutationWebhook=true` annotation from Applications unless absolutely necessary, as it disables the built-in data-masking defense.
Impact:
Successful exploitation allows an attacker to read plaintext Kubernetes Secret values, including credentials, API keys, TLS certificates, and other sensitive configuration data. This can lead to privilege escalation within the cluster, lateral movement, and compromise of dependent services. The confidentiality impact is high, as the exposed data is often critical to application security. While no public exploit is currently available, the vulnerability is easy to trigger and requires only low privileges, making it a significant risk for any organization using affected versions of Argo CD.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
