PT-2026-36558 · Argo Cd · Argo Cd
Hoang-Prod
·
Published
2026-05-02
·
Updated
2026-05-14
·
CVE-2026-43824
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Argo CD versions 3.2.0 through 3.2.10
Argo CD versions 3.3.0 through 3.3.8
Description
The 'ServerSideDiff' endpoint allows the disclosure of cleartext Kubernetes Secret data. This occurs when the
IncludeMutationWebhook variable is set to true on an Application. The handler performs a Kubernetes Server-Side Apply (SSA) dry-run, retrieves raw Secret data from etcd, and returns it in the API response without masking or authorization checks beyond basic login authentication. The data is Base64-encoded, which does not provide encryption.Recommendations
Update versions 3.2.0 through 3.2.10 to version 3.2.11.
Update versions 3.3.0 through 3.3.8 to version 3.3.9.
As a temporary mitigation, ensure the
IncludeMutationWebhook variable is set to false or disabled for all Applications.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Argo Cd