CVE-2026-45737: Argo CD Information Disclosure Flaw

CVE-2026-45737 Overview

CVE-2026-45737 is an information disclosure vulnerability in Argo CD, the declarative GitOps continuous delivery tool for Kubernetes. The flaw affects the ServerSideDiff feature in versions 3.2.0 through 3.2.11, 3.3.0 through 3.3.9, and 3.4.0 through 3.4.1. The HideSecretData(target, live, ...) function does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects. As a result, Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation can appear in UI or CLI diffs. Exposed data includes data, stringData, and annotations. The vulnerability is tracked as CWE-200 (Information Exposure) and is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Critical Impact
Users with permissions to view application diffs can retrieve sensitive Kubernetes Secret contents, including credentials, tokens, and configuration data intended to be masked.

Affected Products

Argo CD versions 3.2.0 through 3.2.11
Argo CD versions 3.3.0 through 3.3.9
Argo CD versions 3.4.0 through 3.4.1

Discovery Timeline

2026-07-15 - CVE-2026-45737 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45737

Vulnerability Analysis

The vulnerability resides in the gitops-engine/pkg/diff/diff.go module used by Argo CD's ServerSideDiff feature. When Argo CD computes a diff between the desired state and the live state of a Kubernetes Secret, it invokes HideSecretData to mask sensitive values. However, the sanitization routine only redacts the data and stringData fields on the top-level Secret objects. It does not process the kubectl.kubernetes.io/last-applied-configuration annotation, which kubectl apply populates with the full previous manifest as JSON. Because that annotation contains the raw Secret payload in cleartext, unmasked credentials surface in the rendered diff output shown through the Argo CD UI or CLI.

Root Cause

The root cause is incomplete sanitization in the ServerSideDiff code path. The HideSecretData function was applied asymmetrically: it processed predictedLive but did not consistently normalize the live object or strip the last-applied-configuration annotation from either side. This annotation preserves a serialized copy of the resource, bypassing the masking logic that operates only on structured Secret fields.

Attack Vector

Exploitation requires network access to the Argo CD instance and a low-privileged authenticated account with permission to view application diffs. An attacker with applications, get or diff-viewing rights on an application that manages Secrets can request the diff view and read Secret values from the annotation content. Because the scope is Changed (S:C), the disclosure crosses trust boundaries between the Argo CD control plane and the workloads it manages.

// Security patch applied in gitops-engine/pkg/diff/diff.go
Normalize(predictedLive, opts...)
unstructured.RemoveNestedField(predictedLive.Object, "metadata", "managedFields")
unstructured.RemoveNestedField(predictedLive.Object, "metadata", "annotations", AnnotationLastAppliedConfig)

Normalize(live, opts...)
unstructured.RemoveNestedField(live.Object, "metadata", "managedFields")
unstructured.RemoveNestedField(live.Object, "metadata", "annotations", AnnotationLastAppliedConfig)

if isCoreSecret(config) {
    // Mask Secret data symmetrically before comparison.
    predictedLive, live, err = HideSecretData(predictedLive, live, nil)
    if err != nil {
        return nil, fmt.Errorf("error hiding secret data for resource %s/%s: %w", config.GetKind(), config.GetName(), err)
    }
}

Source: GitHub Commit 7879e63

The patch removes the last-applied-configuration annotation from both predictedLive and live objects before serialization and applies HideSecretData symmetrically for core Secret resources.

Detection Methods for CVE-2026-45737

Indicators of Compromise

Argo CD application diff API responses (/api/v1/applications/{name}/managed-resources or /api/v1/stream/applications/{name}/resource-tree) containing readable data fields or last-applied-configuration annotations for Secret resources.
Audit log entries showing non-administrator accounts repeatedly requesting diff views for applications that manage Kubernetes Secrets.
Argo CD server versions matching 3.2.0–3.2.11, 3.3.0–3.3.9, or 3.4.0–3.4.1 with ServerSideDiff enabled.

Detection Strategies

Query the Argo CD server version through the /api/version endpoint and flag deployments running affected releases.
Inspect diff API responses in transit or in application logs for base64-encoded Secret payloads embedded in annotation strings.
Correlate Kubernetes RBAC role bindings granting applications, get with subsequent diff API access patterns to identify potential exposure paths.

Monitoring Recommendations

Enable Argo CD access logging and forward events to a centralized SIEM for correlation with identity and RBAC data.
Monitor for anomalous read patterns against applications that deploy Secret resources, especially by service accounts or shared credentials.
Alert on user sessions that enumerate multiple applications in short intervals, which may indicate scripted diff harvesting.

How to Mitigate CVE-2026-45737

Immediate Actions Required

Upgrade Argo CD to version 3.2.12, 3.3.10, or 3.4.2 depending on your current release branch.
Rotate any Kubernetes Secrets that were managed by affected Argo CD instances and may have been viewed through diffs.
Review Argo CD RBAC policies and remove diff or application-read permissions from users who do not require them.

Patch Information

The Argo CD maintainers released fixes in v3.2.12, v3.3.10, and v3.4.2. The corresponding advisory is published as GHSA-rg3g-4rw9-gqrp. Fixes are implemented in commits 7879e63, 87e9148, and ac11bec.

Workarounds

Disable the ServerSideDiff feature by setting application.resourceTrackingMethod and diff strategy back to client-side diff until the upgrade is complete.
Avoid using kubectl apply for Secret resources managed by Argo CD, or manually strip the kubectl.kubernetes.io/last-applied-configuration annotation from live Secrets in the cluster.
Restrict Argo CD project and application access so that only trusted administrators can view diffs for Secret-bearing applications.

bash

# Verify Argo CD server version and upgrade using Helm
kubectl -n argocd exec deploy/argocd-server -- argocd version --short

# Upgrade to a patched release
helm repo update
helm upgrade argocd argo/argo-cd --version <chart-with-argocd-3.4.2> -n argocd

# Remove the last-applied-configuration annotation from existing Secrets as a stopgap
kubectl get secrets -A -o name | while read s; do \
  kubectl annotate $s kubectl.kubernetes.io/last-applied-configuration- --overwrite; \
done