9.6
Critique
CVE-2026-42880 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| argo-cd 3.3 | 3.3.0 → < 3.3.9 | 3.3.9 |
| argo-cd 3.2 | 3.2.0 → < 3.2.11 | 3.2.11 |
| Red Hat OpenShift GitOps 1.19 1779211412 | premières → < 1779211412 | 1779211412 |
| Red Hat OpenShift GitOps 1.2 1779284685 | premières → < 1779284685 | 1779284685 |
| Red Hat Openshift Data Foundation 4 | Versions non publiées | |
| Red Hat OpenShift GitOps | Versions non publiées | |
| Red Hat OpenShift GitOps 1.20 1779284685 | premières → < 1779284685 | 1779284685 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de argo-cd
Les 49 CVE de argo-cd →
CVE-2026-113709
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critique
CVE-2026-113708
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critique
CVE-2026-113672
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critique
CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
Critique