CVE-2026-45737: argoproj argo_cd
Vulnerability summary
CVE-2026-45737 is a medium (CVSS 6.5) vulnerability in argoproj argo_cd. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 15-07-2026PublishedVulnerability first disclosed.
- 16-07-2026Last modifiedVulnerability information updated.
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundArgo Cd
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Affected systems
Chainguard4 products
- argo-cd-3.2< 3.2.12-r0
- argo-cd-3.2-compat< 3.2.12-r0
- argocd-image-updater< 1.2.0-r4
- argocd-image-updater-fips< 1.2.0-r5
Wolfi3 products
- argo-cd-3.2< 3.2.12-r0
- argo-cd-3.2-compat< 3.2.12-r0
- argocd-image-updater< 1.2.0-r4
Argoproj2 products
Github.com/argoproj/argo-cd2 products
- v2All versions (No fix recorded)
- v3≥ 3.2.0, < 3.2.12 | ≥ 3.3.0-rc1, < 3.3.10 | ≥ 3.4.0-rc1, < 3.4.2
Github.com/argoproj1 product
- argo-cdAll versions (No fix recorded)
5 vendors · 12 products
References
11 links- github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrpX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
Show all 11 references
- github.com/argoproj/argo-cdPACKAGE