CVE-2025-23216: Argo CD Secret Exposure Vulnerability

CVE-2025-23216 Overview

CVE-2025-23216 is an information disclosure vulnerability in Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. The flaw exposes Kubernetes Secret values in error messages and diff views when an invalid Secret resource is synced from a Git repository. A user with write access to the repository can commit a malformed Secret and trigger a Sync, which surfaces the decoded secret data. Any user with read access to Argo CD can then view the exposed values. The vulnerability is fixed in Argo CD v2.13.4, v2.12.10, and v2.11.13.

Critical Impact
Secret values stored in Argo CD-managed repositories can leak to any user with read access to the Argo CD UI or API, breaking the confidentiality boundary of GitOps-managed Kubernetes Secrets.

Affected Products

Argoproj Argo CD versions prior to v2.11.13
Argoproj Argo CD v2.12.x versions prior to v2.12.10
Argoproj Argo CD v2.13.x versions prior to v2.13.4

Discovery Timeline

2025-01-30 - CVE-2025-23216 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23216

Vulnerability Analysis

The vulnerability is an information exposure through error messages [CWE-209] combined with sensitive information exposure to unauthorized actors [CWE-200]. When Argo CD attempts to apply an invalid Kubernetes Secret manifest through its Sync workflow, the underlying kubectl apply operation returns an error containing the offending resource. That error text, including the base64-decoded map of the Secret's data field, is preserved and rendered in both the diff view and error surfaces of the Argo CD interface.

Argo CD normally redacts Secret contents in its diff renderer. However, the redaction logic did not run on error paths originating from the gitops-engine diff and kubectl output normalization functions. Any actor with read access to the Application object can therefore retrieve the plaintext value.

Root Cause

The root cause is in the gitops-engine library used by Argo CD, specifically in pkg/diff/diff.go and pkg/utils/kube/kube.go. The cleanKubectlOutput function did not strip Go map representations (map[key:value]) that kubectl appends to error messages when validation fails. Those map representations contained the full decoded Secret payload.

Attack Vector

An actor with write access to a repository monitored by Argo CD commits an intentionally invalid Secret manifest, for example one that references itself or violates schema validation. When the Application syncs, the resulting error message embeds the Secret's data map. Any Argo CD user with read permissions on the Application then views the value in the diff or events pane.

// Patch: pkg/utils/kube/kube.go - strip map[...] payloads from kubectl errors
kubectlErrOutMapRegexp = regexp.MustCompile(`map\[.*\]`)

func cleanKubectlOutput(s string) string {
    s = strings.TrimSpace(s)
    s = kubectlErrOutRegexp.ReplaceAllString(s, "")
    s = kubectlErrOutMapRegexp.ReplaceAllString(s, "")
    s = kubectlApplyPatchErrOutRegexp.ReplaceAllString(s, "")
    s = strings.Replace(s, "; if you choose to ignore these errors, turn validation off with --validate=false", "", -1)
    return s
}

Source: gitops-engine commit 7e21b91

Detection Methods for CVE-2025-23216

Indicators of Compromise

Argo CD Application status.operationState.syncResult or status.conditions entries containing map[ substrings alongside Secret resource kinds.
Recent Git commits introducing malformed kind: Secret manifests followed by Sync operations that fail validation.
Access log entries from argocd-server showing GET requests to /api/v1/applications/{name}/managedResources or the diff endpoint for Applications that manage Secrets.

Detection Strategies

Audit Argo CD argocd-server and argocd-repo-server logs for kubectl error strings containing map[ and the token Secret within the same event.
Correlate repository commits touching Secret manifests with subsequent Sync failures in the Argo CD event stream.
Review Kubernetes audit logs for Application resource reads by principals who do not typically consume Secret data.

Monitoring Recommendations

Alert on Sync failures for resources of kind: Secret and treat them as potential exposure events until reviewed.
Track the running Argo CD version across clusters and flag deployments still on unpatched v2.11.x, v2.12.x, or v2.13.x builds.
Monitor RBAC changes that grant broad applications, get permissions in argocd-rbac-cm.

How to Mitigate CVE-2025-23216

Immediate Actions Required

Upgrade Argo CD to v2.13.4, v2.12.10, or v2.11.13 depending on your release track.
Rotate any Kubernetes Secrets managed through Argo CD that may have been rendered in a failed Sync since the affected versions were deployed.
Restrict repository write access to trusted maintainers and require review on commits that modify kind: Secret resources.

Patch Information

The fix is delivered by bumping the gitops-engine dependency to v0.7.1-0.20250129155113-7e21b91e9d0f and merged via commit 6f5537bd. The upstream engine change adds a map[.*] regex to cleanKubectlOutput so that Secret payloads embedded in kubectl errors are stripped before display. Full details are in the GitHub Security Advisory GHSA-47g2-qmh2-749v.

Workarounds

Remove Secret manifests from Git repositories and manage them through an external secrets operator (for example, External Secrets Operator or Sealed Secrets) so that raw values never enter Argo CD's diff path.
Tighten Argo CD RBAC so that applications, get and applications, sync are scoped to specific projects, reducing the set of users who can read diff output.
Configure resource.exclusions in argocd-cm to exclude Secret kinds from Application tracking where feasible.

bash

# Upgrade Argo CD to a patched release using Helm
helm repo update
helm upgrade argocd argo/argo-cd \
  --namespace argocd \
  --version <chart-version-shipping-argocd-2.13.4>

# Or upgrade via manifest
kubectl apply -n argocd \
  -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.13.4/manifests/install.yaml