CVE-2026-45737 affects Argo CD, a GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 until before 3.2.12, 3.3.10, and 3.4.2, the ServerSideDiff feature can expose sensitive Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. This exposure happens because the HideSecretData function does not fully sanitize the ResourceDiff.TargetState and LiveState predicted live Secret objects, resulting in sensitive data, stringData, and annotations being visible in UI or CLI diffs. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-212 (Exposure of Sensitive Information Through Data Query). The issue is resolved in versions 3.2.12, 3.3.10, and 3.4.2.

An unauthorized actor with at least low privileges could view sensitive Kubernetes Secret data through the Argo CD UI or CLI diffs due to incomplete sanitization of secret data in the ServerSideDiff feature. This exposure could lead to leakage of confidential information, impacting confidentiality without affecting integrity or availability.

This vulnerability is fixed in Argo CD versions 3.2.12, 3.3.10, and 3.4.2. Users should upgrade to one of these versions or later to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information in the description.