CVE-2026-42880

CRITICAL EPSS 29.8%
Published May 7, 20261mo ago · Modified Jun 17, 20261w ago
9.6 CVSS 3.1
Critical
Find Similar
Published May 7, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

CVSS Details

Base Score
9.6
Exploitability
3.1
Impact
5.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
29.8% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-212

Affected Products 2

VendorProductVersionRange
argoprojargo_cd*≥3.2.0  –  <3.2.11
argoprojargo_cd*≥3.3.0  –  <3.3.9

References 1

  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
    ExploitVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.