Argo CD CVE-2026-43824

Exploitation requires valid Argo CD user credentials with at least read permissions on applications that contain Kubernetes Secret resources. The attacker must be able to invoke the ServerSideDiff functionality through Argo CD's API or UI against target applications. No special configuration is required-this affects default Argo CD deployments running vulnerable versions 3.2.0-3.2.10 or 3.3.0-3.3.8. The Changed Scope (S:C) indicates the vulnerability is exploitable even when Argo CD RBAC would normally prevent direct access to certain secrets, as the diff operation bypasses intended Kubernetes RBAC boundaries. User interaction is not required (UI:N). Exploitation is LIMITED by the attacker's existing Argo CD application visibility-users can only diff applications they have read access to within Argo CD's permission model, though this still represents significant privilege escalation into Kubernetes secret data.

This vulnerability presents significant real-world risk despite no confirmed active exploitation (CISA KEV). The CVSS 3.1 score of 7.7 accurately reflects the threat: network-accessible (AV:N), low complexity (AC:L), requiring only low-privileged authentication (PR:L) with no user interaction (UI:N), and causing high confidentiality impact (C:H) that crosses security boundaries (S:C). Attack complexity is genuinely low-any authenticated Argo CD user can invoke ServerSideDiff against applications containing Secrets. The Changed Scope rating is particularly concerning because it means users with limited Argo CD permissions can potentially access Kubernetes secrets they shouldn't see via RBAC. EPSS data not provided, but the technical profile suggests moderate exploitation likelihood once attackers know about it-the barrier is just having valid Argo CD credentials. No public POC mentioned in available data, but the exploit technique is straightforward for anyone familiar with Argo CD's API. Organizations using Argo CD to manage production Kubernetes workloads with sensitive secrets face immediate risk. Priority should be elevated for environments where Argo CD user accounts have broad application visibility, as lateral movement to discover secrets across multiple namespaces becomes trivial.

An authenticated attacker with read access to Argo CD applications leverages the ServerSideDiff API endpoint to compare application manifests against live cluster state. When targeting an application that deploys Kubernetes Secret resources (such as database credentials or API keys), the diff response returns cleartext secret values instead of redacted placeholders. The attacker systematically enumerates applications across namespaces they can view in Argo CD, extracting sensitive credentials for databases, external APIs, cloud provider keys, and service account tokens. These credentials enable lateral movement to backend systems, privilege escalation within the Kubernetes cluster, or exfiltration of application data.