https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for argoproj/argo-cd en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/599 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/599 Tue, 25 Aug 2026 16:12:18 GMT The notification controller's getAppProj function retrieved an AppProject object from the shared informer cache and mutated its annotations in place. Since informer cache objects are shared among goroutines, concurrent calls to getAppProj for multiple applications referencing the same project could result in concurrent map writes, causing a fatal runtime error and crashing the notification controller. The patch deep-copies the object before mutation, ensuring the cache is not modified. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 Mon, 10 Aug 2026 18:09:53 GMT The ServerSideDiff API decided whether to mask Secret data based on the caller-supplied liveResources\[i\].Kind/Group metadata rather than the actual kind of the target/live manifest being diffed. An attacker with get access to an Application could submit a liveResources entry with a spoofed non-Secret Kind (e.g., ConfigMap) paired with a real Secret target manifest at the same index, causing the server to skip masking and return the Secret's plaintext data (e.g., passwords, tokens) in the diff response. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 Tue, 04 Aug 2026 18:04:29 GMT When performing a server-side diff on a Kubernetes Secret, the kubectl.kubernetes.io/last-applied-configuration annotation on the predicted-live (target) resource was not masked, even though the corresponding annotation on the live resource was hidden. Since this annotation can contain the full JSON representation of the applied Secret (including plaintext data values), it could leak secret contents in the diff output (e.g., displayed in Argo CD UI/CLI diffs or logs) even though HideSecretData was meant to redact secret values symmetrically. medium verified