CyberRota Analysis
AI-GeneratedArgo CD versions 3.2.0 to 3.2.12, 3.3.10, and 3.4.2 are vulnerable due to improper sanitization of Kubernetes Secret values in the ServerSideDiff feature, which can inadvertently expose sensitive data in UI or CLI diffs. This could lead to unauthorized access to confidential information, impacting security and compliance. Kubernetes administrators and DevOps teams using affected Argo CD versions should prioritize upgrading to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)