GHSA-fwr2-64vr-xv9m BIT-argo-cd-2023-40029 CVE-2023-40029 GO-2023-2049

Argo CD cluster secret might leak in cluster details page

Critical Go

Severity: 9.9 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 1.20%; Chance of exploitation in the next 30 days. Higher than 68.08% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-532 Insertion of Sensitive Information into Log File
Fix: 2.6.15; Upgrade github.com/argoproj/argo-cd/v2 to this version or later

Description

Impact

Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation.

https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the kubectl.kubernetes.io/last-applied-configuration annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have clusters, get RBAC access.

Note: In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive.

Patches

The bug has been patched in the following versions:

2.8.3
2.7.14
2.6.15

Workarounds

Update/Deploy cluster secret with server-side-apply flag which does not use or rely on kubectl.kubernetes.io/last-applied-configuration annotation. Note: annotation for existing secrets will require manual removal.

For more information

Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/argoproj/argo-cd	`all versions`	No fix yet
github.com/argoproj/argo-cd/v2	`>= 2.2.0, < 2.6.15`	`2.6.15`
github.com/argoproj/argo-cd/v2	`>= 2.7.0, < 2.7.14`	`2.7.14`
github.com/argoproj/argo-cd/v2	`>= 2.8.0, < 2.8.3`	`2.8.3`
github.com/argoproj/argo-cd/v2	`>= 2.2.0, < 2.6.15` `>= 2.7.0, < 2.7.14` `>= 2.8.0, < 2.8.3`	`2.6.15` `2.7.14` `2.8.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/argoproj/argo-cd/v2 Go → `2.6.15`

go

go get github.com/argoproj/argo-cd/v2@v2.6.15 && go mod tidy

Severity breakdown

CVSS 3.1 9.9

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: Low

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-532: Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

How to prevent it

Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution: Remove debug log files before deploying the application into production.
Operation: Protect log files against unauthorized read/write.
Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2023-40029

Packages

github.com/argoproj/argo-cd

Timeline

Sep 7, 2023 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical	Also affects github.com/argoproj/argo-cd
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High	Also affects github.com/argoproj/argo-cd
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High	Also affects github.com/argoproj/argo-cd
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium	Also affects github.com/argoproj/argo-cd
GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction	Critical	Also affects github.com/argoproj/argo-cd
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High	Also affects github.com/argoproj/argo-cd
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High	Also affects github.com/argoproj/argo-cd
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High	Also affects github.com/argoproj/argo-cd

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor