CVE-2026-45737
published 2026-07-15CVE-2026-45737: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.36%
29.2th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | >= 3.2.0 < 3.2.12 | 3.2.12 |
| argoproj | argo_cd | >= 3.3.9 < 3.3.10 | 3.3.10 |
| argoproj | argo_cd | >= 3.4.1 < 3.4.2 | 3.4.2 |
| github.com | argoproj_argo-cd_v3 | >= 3.2.0 < 3.2.12 | 3.2.12 |
| github.com | argoproj_argo-cd_v3 | >= 3.3.0-rc1 < 3.3.10 | 3.3.10 |
| github.com | argoproj_argo-cd_v3 | >= 3.4.0-rc1 < 3.4.2 | 3.4.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
argoproj argo-cd up to 3.2.11/3.3.9/3.4.1 ServerSideDiff information disclosure
vuldb·2026-07-15·CVSS 6.3
CVE-2026-45737 [MEDIUM] argoproj argo-cd up to 3.2.11/3.3.9/3.4.1 ServerSideDiff information disclosure
A vulnerability, which was classified as problematic, has been found in argoproj argo-cd up to 3.2.11/3.3.9/3.4.1. This affects an unknown function of the component ServerSideDiff. This manipulation causes information disclosure.
This vulnerability is tracked as CVE-2026-45737. The attack is possible to be carried out remotely. No exploit exists.
GHSA
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
ghsa·2026-05-19
CVE-2026-45737 [MEDIUM] CWE-200 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
### Summary
The original fix for [GHSA-3v3m-wc6v-x4x3](https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3) is incomplete. argocd app diff --server-side-diff can still expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation.
The prior fix masks top-level Secret data in ServerSideDiff responses, but it does not fully sanitize Secret data stored inside the last-applied-configuration annotation. If a Secret was previously created or updated using client-side apply, that annotation may contain raw data, stringData, and sensitive annotations. These values can be shown in UI/CLI diffs.
### Details
The ServerSideDiff endpoint retu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42chttps://github.com/argoproj/argo-cd/releases/tag/v3.2.12https://github.com/argoproj/argo-cd/releases/tag/v3.3.10https://github.com/argoproj/argo-cd/releases/tag/v3.4.2https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrphttps://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp
2026-07-15
Published