Dashboard / CVE-2026-45737

CVE-2026-45737

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 63/100
Published: 2026-07-15 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
argoproj argo_cd 3.2.0 – 3.2.12

References & Advisories (8)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.52%
Raw Score 0.005210
Percentile 44.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00521
2026-10-28
0.00521

Intelligence Sources

nvd ref →

External Links