Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (argoproj argo-cd)

CVE-2026-45737

MEDIUM 6.3

En bref

Source: NVD
EPSS: EPSS 0.52 % · centile 44 (2026-10-30)
État: PUBLISHED
Publiée: 2026-07-15 20:00 UTC
Mise à jour: 2026-07-16 19:14 UTC
Attribuée par: GitHub_M
Statut NVD: Analyzed

Rechercher sur…

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Faiblesses (CWE)

CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
CWE-212 — Suppression incorrecte d'informations sensibles avant stockage ou transfert

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N	GitHub_M
CVSS 3.1	MEDIUM 6.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)

Avis

GHSA-rg3g-4rw9-gqrp — Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
GO-2026-5618 — Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Références européennes

ENISA EUVD · EUVD-2026-44792
GCVE · GCVE-0-2026-45737

Configurations affectées (CPE NVD)

cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.2.12
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 3.3.9 < 3.3.10
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 3.4.1 < 3.4.2

Produits affectés

Produit	Versions
argoproj · argo-cd	affected >= 3.2.0, < 3.2.12 ; affected >= 3.3.9, < 3.3.10 ; affected >= 3.4.1, < 3.4.2

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (argoproj argo-cd)