VYPR
← All advisories
Critical severity9.6GHSA Advisory· Published May 7, 2026· Updated Aug 11, 2026

CVE-2026-42880

CVE-2026-42880

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/argoproj/argo-cd/v3Go
>= 3.2.0, < 3.2.113.2.11
github.com/argoproj/argo-cd/v3Go
>= 3.3.0, < 3.3.93.3.9

Affected products

8

Patches

Vulnerability mechanics

References

9

News mentions

1