Argo CD versions 3.2.0 through 3.2.10 and 3.3.0 through 3.3.8 contain a vulnerability in the ServerSideDiff endpoint where missing authorization and data masking allow an attacker with read-only privileges to extract sensitive Kubernetes Secret data. This occurs by exploiting the Kubernetes API server's Server-Side Apply dry-run feature, which inadvertently exposes plaintext secret information stored in etcd. The vulnerability is tracked as CWE-200 (Exposure of Sensitive Information), CWE-201 (Insertion of Sensitive Information Into Sent Data), and CWE-212. The issue has been addressed in Argo CD versions 3.2.11 and 3.3.9. Red Hat's advisory confirms the vulnerability and recommends upgrading to fixed versions, noting that no suitable mitigation currently exists that meets their standards.

An attacker with read-only access to Argo CD can leverage this vulnerability to extract plaintext Kubernetes Secret data, potentially exposing critical configuration and credentials. This exposure compromises confidentiality and could lead to further security breaches if the secrets are used to access other systems or services. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low complexity, low privileges required, no user interaction, and changed scope with high confidentiality and integrity impacts.

A fix is available in Argo CD versions 3.2.11 and 3.3.9. Users should upgrade to these or later versions to remediate the vulnerability. According to Red Hat's advisory, no effective mitigation other than upgrading currently meets their criteria for ease of use, applicability, and stability. Therefore, upgrading to a fixed version is the recommended and primary remediation step.