CVE-2026-43824: Argo CD Information Disclosure Flaw

CVE-2026-43824 Overview

CVE-2026-43824 is an information disclosure vulnerability in Argo CD, the declarative GitOps continuous delivery tool for Kubernetes. The flaw resides in the ServerSideDiff feature and allows authenticated users to read cleartext Kubernetes Secret data that should remain protected. The issue affects Argo CD versions 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9. The vulnerability is classified under [CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer]. Attackers with low-privilege network access can exfiltrate sensitive credentials, API tokens, and certificates stored in Kubernetes Secrets.

Critical Impact

Authenticated users can read cleartext Kubernetes Secret values through the ServerSideDiff feature, exposing credentials and sensitive configuration data managed by Argo CD.

Affected Products

• Argo CD versions 3.2.0 through 3.2.10
• Argo CD versions 3.3.0 through 3.3.8
• Kubernetes clusters managed via Argo CD with ServerSideDiff enabled

Discovery Timeline

• 2026-05-02 - CVE-2026-43824 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-43824

Vulnerability Analysis

Argo CD synchronizes Kubernetes resources from Git repositories to target clusters and presents diffs between desired and live state. The ServerSideDiff feature performs the diff computation server-side using the Kubernetes API server's dry-run apply capability. This produces more accurate results than client-side diffs by accounting for admission controllers and defaulting logic.

The vulnerability stems from improper redaction of sensitive fields when generating server-side diff output. Argo CD normally masks Secret values in the UI and API responses to prevent disclosure. With ServerSideDiff enabled, the redaction logic fails to scrub cleartext Secret data from diff results returned to users with application read access.

An authenticated user with permission to view application diffs can read decoded values for any Secret managed under that application. This exposes credentials such as database passwords, cloud provider keys, OAuth client secrets, and TLS private keys.

Root Cause

The root cause is an incomplete sensitive data sanitization path in the ServerSideDiff code path. The standard client-side diff routine masks Secret data and stringData fields before returning results, but the server-side equivalent did not apply equivalent redaction to the live and desired manifests retrieved from the cluster.

Attack Vector

Exploitation requires network access to the Argo CD API or web UI and valid credentials with applications, get permission on a target application. The attacker requests the application diff while ServerSideDiff is active and parses the response payload to extract cleartext Secret values. No user interaction or elevated privileges beyond standard read access are required, and the vulnerability crosses a security boundary by exposing data the user is not authorized to view in cleartext.

For full technical details, see the Argo CD GitHub Security Advisory GHSA-3v3m-wc6v-x4x3.

Detection Methods for CVE-2026-43824

Indicators of Compromise

• Unusual volume of GET requests to Argo CD application diff endpoints from a single user or service account
• Application diff API calls targeting applications that manage Kubernetes Secrets
• Argo CD audit log entries showing repeated diff operations on Secret-bearing applications
• Subsequent authentication attempts using credentials sourced from disclosed Secrets

Detection Strategies

• Inventory Argo CD instances and identify deployments running versions 3.2.0–3.2.10 or 3.3.0–3.3.8
• Audit which applications have ServerSideDiff enabled and contain v1/Secret resources
• Review Argo CD RBAC policies to enumerate users with applications, get permissions across Secret-managing applications
• Correlate Argo CD API access logs with Kubernetes audit logs to detect anomalous Secret read patterns

Monitoring Recommendations

• Forward Argo CD server logs and Kubernetes API server audit logs to a centralized SIEM for correlation
• Alert on diff API requests that return responses exceeding normal payload sizes for Secret-bearing applications
• Monitor for credential reuse patterns where Secret values appear in authentication attempts shortly after diff API access
• Track changes to Argo CD application.resourceTrackingMethod and controller.diff.server.side configuration flags

How to Mitigate CVE-2026-43824

Immediate Actions Required

• Upgrade Argo CD to version 3.2.11 or 3.3.9 or later as soon as possible
• Rotate all Kubernetes Secrets managed by affected Argo CD instances, including database credentials, API tokens, and TLS keys
• Review Argo CD RBAC and remove unnecessary applications, get permissions from users and service accounts
• Audit historical access logs to identify users who may have already retrieved Secret data

Patch Information

The Argo CD maintainers released fixes in versions 3.2.11 and 3.3.9. The patch corrects the ServerSideDiff redaction logic so that Secret data and stringData fields are masked consistently with the client-side diff path. Refer to the Argo CD GitHub Security Advisory GHSA-3v3m-wc6v-x4x3 for the complete fix details and release notes.

Workarounds

• Disable ServerSideDiff globally by setting controller.diff.server.side.enabled: false in the Argo CD configuration until patching is complete
• Restrict applications, get RBAC permissions to a minimal set of trusted operators
• Move sensitive Secret material out of Argo CD-managed manifests and use external secret managers such as Vault, AWS Secrets Manager, or Sealed Secrets with the External Secrets Operator
• Enforce network policies that limit access to the Argo CD API server to authorized administrative networks

# Configuration example: disable ServerSideDiff in argocd-cmd-params-cm
kubectl -n argocd patch configmap argocd-cmd-params-cm \
  --type merge \
  -p '{"data":{"controller.diff.server.side":"false"}}'

# Restart the application controller to apply changes
kubectl -n argocd rollout restart statefulset argocd-application-controller

# Verify Argo CD version after upgrade
argocd version --short