Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Argoproj | Argo Cd | >= 3.2.0, < 3.2.12 |
Related Weaknesses (CWE)
References
- https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36cPatch
- https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c67Patch
- https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347efPatch
- https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983fPatch
- https://github.com/argoproj/argo-cd/releases/tag/v3.2.12Release Notes
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.10Release Notes
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.2Release Notes
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrpExploitVendor Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrpExploitVendor Advisory
FAQ
What is CVE-2026-45737?
CVE-2026-45737 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl...
How severe is CVE-2026-45737?
CVE-2026-45737 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45737?
Check the references section above for vendor advisories and patch information. Affected products include: Argoproj Argo Cd.