PT-2026-41971 · Argo Cd · Argo Cd

CVE-2026-45737 · Published 2026-05-19 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Argo CD (affected versions not specified)

Description An incomplete fix in the server-side diff functionality allows authenticated users to view sensitive Kubernetes Secret values. When using the argocd app diff --server-side-diff command, the system fails to fully sanitize Secret data stored within the kubectl.kubernetes.io/last-applied-configuration annotation. This occurs because the HideSecretData() function only rewrites the annotation on the live state object, leaving the predicted live state object unmasked. Consequently, raw data, stringData, and sensitive annotations from Secrets created via client-side apply can be exposed in the UI or CLI diffs through the 'ServerSideDiff' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

CWE-212

Related Identifiers

BIT-ARGO-CD-2026-45737

CLEANSTART-2026-EH36582

CLEANSTART-2026-HO16255

CLEANSTART-2026-KL41807

CLEANSTART-2026-QT53274

CLEANSTART-2026-WF25734

CVE-2026-45737

GHSA-RG3G-4RW9-GQRP

GO-2026-5618

OPENSUSE-SU-2026:21483-1

Affected Products

Argo Cd

References · 1906

• 🔥 https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45737.json · Exploit
• https://github.com/argoproj/argo-cd/commit/bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c · Patch
• https://github.com/argoproj/argo-cd/commit/ac11bec9986807adc8886ef1181eced7347ef5c6 · Patch
• https://github.com/argoproj/argo-cd/commit/87e9148320749693624d08e3d6fa2cc217c672a0 · Patch
• https://github.com/argoproj/argo-cd/commit/7879e6322465080a82d152bf00f2b92e0f36c658 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-46595 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EH36582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39832 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45570 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-KL41807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59537 · Security Note
• https://osv.dev/vulnerability/BIT-argo-cd-2026-45737 · Vendor Advisory