CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD

What is CVE-2023-40029?

CVE-2023-40029 is a critical vulnerability in Argoproj Argo Cd, published on 7 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. **Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive. The bug has been patched in versions 2.8.3, 2.7.14, and 2.6.15. Users are advised to upgrade. Users unable to upgrade should update/deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.

Weakness: CWE-532, CWE-200

Which versions are affected by CVE-2023-40029?

9 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2, argo-cd and github.com/argoproj/argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2023-40029?

Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.6.15, 2.7.14 or 2.8.3.

Is CVE-2023-40029 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40029 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8
• CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction Critical 9.6

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-cd-2023-40029, GHSA-fwr2-64vr-xv9m, GO-2023-2049.