TGViewer
DevOps & SRE notes DevOps & SRE notes @devops_sre_notes · 13.3K subscribers
Post #2668 2.93K
Any user with Argo CD application get permissions can extract real Kubernetes Secret values including service account tokens, TLS certificates, database credentials, and API keys. On Applications where IncludeMutationWebhook=true is already set, exploitation requires only read-only Argo CD access.

https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
GitHub Kubernetes Secret Extraction via ArgoCD ServerSideDiff ### Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data...
  • 👏 7
Open in Telegram All posts from @devops_sre_notes
More from @devops_sre_notes
  1. Sep 24, 2026Post #2749
  2. Sep 23, 2026Post #2747
  3. Sep 22, 2026Realtime log viewer with web UI, tail -f for logs with a web interface browser. https://gi…
  4. Sep 21, 2026Securing every Kubernetes workload at scale — LinkedIn Engineering https://www.linkedin.co…
  5. Sep 18, 2026Validate environment variable usage in codebase https://github.com/Chrilleweb/dotenv-diff
  6. Sep 17, 2026Failure is inevitable: Learning from a large outage, and building for reliability in depth…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →