Argo CD versions 3.2.0 prior to 3.2.11 and 3.3.0 prior to 3.3.9 contain a vulnerability (CWE-212) related to improper removal of sensitive information before storage or transfer. Specifically, the ServerSideDiff component allows reading of Kubernetes Secret data in cleartext, potentially exposing sensitive credentials or secrets. The CVSS 3.1 base score is 7.7, indicating a high severity vulnerability with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacting confidentiality with a scope change. The vendor advisory from Red Hat does not explicitly state patch availability or remediation steps.

The vulnerability allows an attacker with low privileges to read sensitive Kubernetes Secret data in cleartext via the ServerSideDiff feature of Argo CD. This compromises confidentiality of secret information managed by Kubernetes, which could lead to unauthorized access to protected resources or credentials. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-43824 for current remediation guidance. Until an official fix is confirmed, restrict access to Argo CD ServerSideDiff functionality to trusted users only and monitor for any unusual access patterns. Avoid exposing Argo CD interfaces to untrusted networks. Follow vendor updates closely for patch releases.