{"id":"CVE-2026-42880","state":"PUBLISHED","title":"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.","publishedAt":"2026-05-07T22:20:39.506Z","updatedAt":"2026-09-07T12:04:55.409Z","severity":{"score":9.6,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["argoproj argo-cd"],"affected":[{"vendor":"argoproj","product":"argo-cd","versions":[{"version":">= 3.2.0, < 3.2.11","status":"affected"},{"version":">= 3.3.0, < 3.3.9","status":"affected"}]}],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","https://access.redhat.com/security/cve/CVE-2026-42880","https://bugzilla.redhat.com/show_bug.cgi?id=2467882","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20947","https://access.redhat.com/errata/RHBA-2026:12433"],"weaknesses":["CWE-200","CWE-212","CWE-201"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/42xxx/CVE-2026-42880.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-42880","state":"PUBLISHED","datePublished":"2026-05-07T22:20:39.506Z","dateUpdated":"2026-09-07T12:04:55.409Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-30T18:49:06.711Z"},"containers":{"cna":{"title":"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction","descriptions":[{"lang":"en","value":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."}],"affected":[{"vendor":"argoproj","product":"argo-cd","versions":[{"version":">= 3.2.0, < 3.2.11","status":"affected"},{"version":">= 3.3.0, < 3.3.9","status":"affected"}]}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","name":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-212","lang":"en","description":"CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-07T22:20:39.506Z"},"source":{"advisory":"GHSA-3v3m-wc6v-x4x3","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T00:00:00+00:00","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-42880"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-14T03:56:28.920Z"}},{"title":"argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism","descriptions":[{"lang":"en","value":"A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps 1.19","packageName":"openshift-gitops-1/argocd-image-updater-rhel8","defaultStatus":"affected","versions":[{"version":"1779211412","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.19::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps 1.20","packageName":"openshift-gitops-1/argocd-rhel9","defaultStatus":"affected","versions":[{"version":"1776942799","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps 1.20","packageName":"openshift-gitops-1/argocd-agent-rhel9","defaultStatus":"affected","versions":[{"version":"1779285564","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps 1.20","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","defaultStatus":"affected","versions":[{"version":"1779285074","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps 1.20","packageName":"openshift-gitops-1/gitops-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1779284685","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/odf-multicluster-rhel9-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/argocd-agent-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/argocd-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/gitops-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/gitops-rhel8-operator","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/gitops-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-42880","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467882","name":"RHBZ#2467882","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20943","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20947","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHBA-2026:12433","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-07T12:04:55.409Z"},"datePublic":"2026-05-07T22:20:39.506Z","solutions":[{"lang":"en","value":"RHSA-2026:20943: Red Hat OpenShift GitOps 1.19"},{"lang":"en","value":"RHSA-2026:20947: Red Hat OpenShift GitOps 1.20"},{"lang":"en","value":"RHBA-2026:12433: Red Hat OpenShift GitOps 1.20"}],"timeline":[{"lang":"en","time":"2026-05-07T23:00:58.796Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-07T22:20:39.506Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}