cloud-service-vulnerabilitywidely-deployed-product-advisoryleaked-secret-api-keyidentity-authentication-vulnerability

Argo CD ServerSideDiff flaw exposed plaintext Kubernetes Secrets

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 6, 2026

A critical flaw in Argo CD, tracked as CVE-2026-43824, exposed plaintext Kubernetes Secrets to low-privileged authenticated users through the ServerSideDiff endpoint. The vulnerability was caused by missing authorization and secret-masking protections, allowing the endpoint to return raw PredictedLive and NormalizedLive data from the Kubernetes API without applying Argo CD’s normal hideSecretData() masking. As a result, users with application get access could retrieve sensitive values including service account tokens, TLS material, database credentials, and API keys.

The risk was heightened when an Application used the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true, which bypassed an additional sanitization step and made secret extraction especially effective for resources influenced by mutation webhooks. The issue affected Argo CD versions 3.2.0 through 3.3.8, and maintainers released fixes in 3.2.11 and 3.3.9. Administrators were urged to upgrade, tighten RBAC permissions, remove the risky annotation where possible, and review Argo CD API logs for suspicious ServerSideDiff activity.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · May 1, 2026 – May 6, 2026

May 6, 20266mo ago
Public reporting details affected Argo CD versions and mitigations
Public reporting described the vulnerability as affecting Argo CD versions 3.2.0 through 3.3.8 and advised administrators to upgrade to 3.3.9 or 3.2.11. It also recommended restricting RBAC permissions, removing the risky annotation where possible, and monitoring Argo CD API logs for suspicious ServerSideDiff activity.
Argo CD's ServerSideDiff Vulnerability Enables Kubernetes Secret Extraction
May 1, 20266mo ago
Argo CD publishes advisory for CVE-2026-43824
A GitHub security advisory disclosed CVE-2026-43824, a missing authorization and secret-masking flaw in Argo CD's ServerSideDiff endpoint that can expose plaintext Kubernetes Secret data to authenticated users. The advisory also described how the IncludeMutationWebhook=true annotation can bypass an additional safeguard and included a proof of concept for secret extraction.
Kubernetes Secret Extraction via ArgoCD ServerSideDiff · Advisory · argoproj/argo-cd · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Argo CD ServerSideDiff cleartext Kubernetes Secret disclosure (CVE-2026-43824)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · May 6, 2026

Argo CD's ServerSideDiff Vulnerability Enables Kubernetes Secret ExtractionOpen source ↗

Github Advisories Github LinkNews · May 1, 2026

Kubernetes Secret Extraction via ArgoCD ServerSideDiff · Advisory · argoproj/argo-cd · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Argo CD ServerSideDiff flaw exposed plaintext Kubernetes Secrets

How this story unfolded

Public reporting details affected Argo CD versions and mitigations

Argo CD publishes advisory for CVE-2026-43824

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Argo CD repo-server RCE exposes Kubernetes clusters to takeover

Unpatched Argo CD Repo-Server RCE Enables Kubernetes Cluster Takeover

Kubernetes CI/CD Flaws in Tekton and Argo Require Immediate Patching

Argo CD ServerSideDiff flaw exposed plaintext Kubernetes Secrets

How this story unfolded

Public reporting details affected Argo CD versions and mitigations

Argo CD publishes advisory for CVE-2026-43824

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Argo CD repo-server RCE exposes Kubernetes clusters to takeover

Unpatched Argo CD Repo-Server RCE Enables Kubernetes Cluster Takeover

Kubernetes CI/CD Flaws in Tekton and Argo Require Immediate Patching