https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for argoproj/argo-cd en-us Tue, 11 Aug 2026 21:01:38 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/403 Mon, 10 Aug 2026 18:09:53 GMT The ServerSideDiff API decided whether to mask Secret data based on the caller-supplied liveResources\[i\].Kind/Group metadata rather than the actual kind of the target/live manifest being diffed. An attacker with get access to an Application could submit a liveResources entry with a spoofed non-Secret Kind (e.g., ConfigMap) paired with a real Secret target manifest at the same index, causing the server to skip masking and return the Secret's plaintext data (e.g., passwords, tokens) in the diff response. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/367 Tue, 04 Aug 2026 18:04:29 GMT When performing a server-side diff on a Kubernetes Secret, the kubectl.kubernetes.io/last-applied-configuration annotation on the predicted-live (target) resource was not masked, even though the corresponding annotation on the live resource was hidden. Since this annotation can contain the full JSON representation of the applied Secret (including plaintext data values), it could leak secret contents in the diff output (e.g., displayed in Argo CD UI/CLI diffs or logs) even though HideSecretData was meant to redact secret values symmetrically. medium verified