CVE-2026-45737

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45737
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45737.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45737
Aliases
Downstream
Related
Published
2026-07-15T20:00:46.998Z
Modified
2026-07-21T03:47:04.855149493Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Details

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45737.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-212"
    ]
}
References

Affected packages

Git / github.com/argoproj/argo-cd

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
66b2f302d91a42cc151808da0eec0846bbe1062c
Fixed
1966269fdc1c334a7769bd50341cf4d53490142d
Introduced
1b1bb48f981385cf40b282e965cf63419be3d93f
Fixed
4e8d8b5d05451d76412b36122d6803a90b4f406e
Introduced
bafd59bd37138ed731d3c3aad8e18731d72aed46
Fixed
0dc6b1b57dd5bb925d5b03c3d09419ab9fb4225e
Fixed
7879e6322465080a82d152bf00f2b92e0f36c658
Fixed
87e9148320749693624d08e3d6fa2cc217c672a0
Fixed
ac11bec9986807adc8886ef1181eced7347ef5c6
Fixed
bcb4298afc9fcff5f5d69f4e1db2d0a75983f42c
Database specific 
{
    "cpe": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.12"
        },
        {
            "introduced": "3.3.9"
        },
        {
            "fixed": "3.3.10"
        },
        {
            "introduced": "3.4.1"
        },
        {
            "fixed": "3.4.2"
        }
    ]
}

Affected versions

Other
stable
v3.*
v3.2.0
v3.2.1
v3.2.10
v3.2.11
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.9
v3.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45737.json"