CVE-2026-45737

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658	Patch
https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0	Patch
https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6	Patch
https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c	Patch
https://github.com/argoproj/argo-cd/releases/tag/v3.2.12	Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.3.10	Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.4.2	Release Notes
https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp	Exploit Vendor Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:argoproj:argo_cd::::::::
	cpe:2.3:a:argoproj:argo_cd::::::::

History

No history.

Information

Published : 2026-07-15 20:17

Updated : 2026-07-20 02:09

NVD link : CVE-2026-45737

Mitre link : CVE-2026-45737

CVE.ORG link : CVE-2026-45737

JSON object : View

Products Affected

argoproj

argo_cd

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

{"id": "CVE-2026-45737", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45737", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T19:14:28.622751Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "argoproj", "product": "argo-cd", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.2.12"}, {"status": "affected", "version": ">= 3.3.9, < 3.3.10"}, {"status": "affected", "version": ">= 3.4.1, < 3.4.2"}]}]}], "published": "2026-07-15T20:17:04.907", "references": [{"url": "https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.2.12", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.3.10", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.4.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2."}], "lastModified": "2026-07-20T02:09:23.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A09282B-3656-43B7-96B5-48BD614C2470", "versionEndExcluding": "3.2.12", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D624265-59FA-45D0-AB59-2A13935E1544", "versionEndExcluding": "3.3.10", "versionStartIncluding": "3.3.9"}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE83EFFA-7F8F-4A37-AB3A-8A2D4DBF3484", "versionEndExcluding": "3.4.2", "versionStartIncluding": "3.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}