{"id":"CVE-2026-42880","published":"2026-05-07T22:20:39Z","modified":"2026-09-07T12:04:55Z","title":"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00645,"percentile":0.50789,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-212","name":"Improper Removal of Sensitive Information Before Storage or Transfer"},{"id":"CWE-201","name":"Insertion of Sensitive Information Into Sent Data"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42880","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467882","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20943","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20947","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHBA-2026:12433","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":10.16},{"name":"CVSS severity","points":6.72}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 3.2.0, < 3.2.11",">= 3.3.0, < 3.3.9"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v3","vulnerableRanges":[">=3.2.0, <3.2.11",">=3.3.0, <3.3.9"],"patched":["3.2.11","3.3.9"],"from":["GHSA-3v3m-wc6v-x4x3","GO-2026-5099"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2026-5099"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2026-5099"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-28469","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2022-24904","parents":[{"from":"CVE-2026-43824","to":"CVE-2026-42880","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-3v3m-wc6v-x4x3","via":"reference","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same product + CWE + description similarity"}]}],"children":[{"from":"CVE-2026-42880","to":"CVE-2026-113672","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-3v3m-wc6v-x4x3","via":"related"}]}],"packageHistory":[{"cve":"CVE-2025-59531","published":"2025-10-01","fixed":"3.2.0-rc2","kev":false},{"cve":"CVE-2025-59537","published":"2025-10-01","fixed":"3.2.0-rc2","kev":false},{"cve":"CVE-2025-59538","published":"2025-10-01","fixed":"3.2.0-rc2","kev":false},{"cve":"CVE-2026-42880","published":"2026-05-07","fixed":"3.3.9","kev":false},{"cve":"CVE-2026-43824","published":"2026-05-02","fixed":"3.3.9","kev":false},{"cve":"CVE-2026-45737","published":"2026-07-15","fixed":"3.4.2","kev":false,"link":{"from":"CVE-2026-42880","to":"CVE-2026-45737","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v3","fromFixed":"3.2.11","toFixed":"3.2.12","daysApart":69}]}},{"cve":"CVE-2026-45738","published":"2026-07-15","fixed":"3.4.2","kev":false,"link":{"from":"CVE-2026-42880","to":"CVE-2026-45738","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v3","fromFixed":"3.2.11","toFixed":"3.2.12","daysApart":69}]}}],"package":"Go:github.com/argoproj/argo-cd/v3"}}