CVE-2026-42880
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Argo CD versions 3.2.0 to 3.2.10 and 3.3.0 to 3.3.8, there is a missing authorization and data-masking gap in the ServerSideDiff endpoint. This allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism.
Risk Assessment
The organization is at risk of leaking sensitive data stored in Kubernetes Secrets, such as passwords, tokens, or API keys, which could lead to privilege escalation and compromise of the entire cluster.
Recommendation
Update Argo CD to version 3.2.11 or 3.3.9 immediately, where the vulnerability is patched. Until then, restrict access to the ServerSideDiff endpoint for users with read-only permissions.
Other vulnerabilities in Argo CD
See all- CVE-2026-45738High
A vulnerability in Argo CD allows users with application write access to set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered as anchor href values in the Summary tab URLs section without URL validation, enabling JavaScript execution in a higher-privileged user's authenticated session. The issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
- CVE-2026-45737Medium
Argo CD ServerSideDiff in versions 3.2.0 through 3.2.12, 3.3.10, and 3.4.2 fails to properly sanitize Kubernetes Secret data, potentially exposing sensitive values including those in the kubectl.kubernetes.io/last-applied-configuration annotation. This allows sensitive data to appear in the UI or CLI diffs.
- CVE-2026-15416High
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
- CVE-2026-43824High
A vulnerability in Argo CD versions 3.2.0 through 3.2.10 and 3.3.0 through 3.3.8 allows reading cleartext Kubernetes Secret data via the ServerSideDiff feature.
- CVE-2023-40025Medium
Argo CD, a GitOps continuous delivery tool for Kubernetes, has a bug in versions starting from 2.6.0 that causes open web terminal sessions to not expire. This allows users to send websocket messages even after the token has expired.
- CVE-2022-41354Medium
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. The problem stems from missing proper access controls.
Original NVD description (English source)
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS