CVE-2026-45737: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

The original fix for GHSA-3v3m-wc6v-x4x3 is incomplete. argocd app diff –server-side-diff can still expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation.

The prior fix masks top-level Secret data in ServerSideDiff responses, but it does not fully sanitize Secret data stored inside the last-applied-configuration annotation. If a Secret was previously created or updated using client-side apply, that annotation may contain raw data, stringData, and sensitive annotations. These values can be shown in UI/CLI diffs.