9.6
Critical
CVE-2026-42880 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| argo-cd 3.3 | 3.3.0 → < 3.3.9 | 3.3.9 |
| argo-cd 3.2 | 3.2.0 → < 3.2.11 | 3.2.11 |
| Red Hat OpenShift GitOps 1.19 1779211412 | earliest → < 1779211412 | 1779211412 |
| Red Hat OpenShift GitOps 1.2 1779284685 | earliest → < 1779284685 | 1779284685 |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift GitOps 1.20 1779284685 | earliest → < 1779284685 | 1779284685 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of argo-cd
The 49 CVEs of argo-cd →
CVE-2026-113709
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critical
CVE-2026-113708
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critical
CVE-2026-113672
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critical
CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critical