CVE-2026-45737 argoproj CVE debrief

Who should care

Users of Argo CD, especially those managing Kubernetes environments, should be aware of this vulnerability. If you're using affected versions of Argo CD, you should consider upgrading to a patched version to prevent potential sensitive data exposure.

Technical summary

The vulnerability in Argo CD's ServerSideDiff feature allows sensitive information from Kubernetes Secrets to be exposed in diff outputs. This happens because the HideSecretData function does not properly sanitize Secret objects in ResourceDiff.TargetState and LiveState. Specifically, the issue arises from the incomplete handling of Secret data, stringData, and annotations. The vulnerability is rated MEDIUM with a CVSS score of 6.3. Affected versions include Argo CD 3.2.0 through 3.2.12, 3.3.10, and 3.4.2. The issue is addressed in versions 3.2.12, 3.3.10, and 3.4.2.

Defensive priority

Medium priority should be given to patching this vulnerability, especially in environments where sensitive data is frequently handled.

Recommended defensive actions

• Upgrade Argo CD to version 3.2.12, 3.3.10, or 3.4.2, or later.
• Review and update configurations to limit access to diff outputs.
• Monitor for any unusual activity related to Secret data exposure.
• Perform a thorough review of current Argo CD deployments to identify potential exposure.
• Implement additional monitoring to detect potential unauthorized access to sensitive data.
• Conduct a thorough asset inventory to ensure all affected systems are accounted for.
• Establish a rollback plan in case issues arise during the upgrade process.

Evidence notes

The CVE record was published on 2026-07-15T20:17:04.907Z and was last modified on 2026-07-16T20:16:45.163Z. The NVD entry is currently Undergoing Analysis. Multiple source references are provided, including commits and release tags from the Argo CD project.

Official resources