Critical · published September 7, 2023
🚨 A sneaky annotation is exposing your secrets! The `kubectl.kubernetes.io/last-applied-configuration` annotation in Argo CD stores the full secret body, and that can spell trouble for your sensitive data. 🔥 Think of it like a takeout order receipt accidentally including your credit card details — the kitchen might not know it's sensitive, but anyone who gets that receipt can see everything. That's exactly what this annotation does: it exposes private info under the guise of normal operation. An attacker with the right RBAC access could waltz in and snatch sensitive information, like bearer tokens, which could lead to unauthorized access and full control of your Kubernetes cluster. This isn't just a minor leak — it's like leaving the vault door wide open!
Think of it like a takeout order receipt accidentally including your credit card details — the kitchen might not know it's sensitive, but anyone who gets that receipt can see everything. That's exactly what this annotation does: it exposes private info under the guise of normal operation. This vulnerability allows sensitive information stored in cluster secrets to be exposed through the `kubectl.kubernetes.io/last-applied-configuration` annotation, which can be accessed by users who have `clusters, get` RBAC permissions. If exploited, it could lead to unauthorized access to critical secrets.
An attacker with the right RBAC access could waltz in and snatch sensitive information, like bearer tokens, which could lead to unauthorized access and full control of your Kubernetes cluster. This isn't just a minor leak — it's like leaving the vault door wide open! Upgrade Argo CD to versions 2.8.3, 2.7.14, or 2.6.15 to close this vulnerability immediately. If upgrading isn't possible right now, deploy cluster secrets with the `server-side-apply` flag to avoid using this risky annotation. Don't forget to manually remove the annotation from existing secrets! You've got this! Follow these steps to secure your setup and keep those secrets safe! 🛡️