CVE-2026-42880
published 2026-05-07CVE-2026-42880: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing…
PriorityP265critical9.6CVSS 3.1
AVNACLPRLUINSCCHIHAN
EPSS
0.51%
41.3th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | >= 3.2.0 < 3.2.11 | 3.2.11 |
| argoproj | argo_cd | >= 3.3.0 < 3.3.9 | 3.3.9 |
| github.com | argoproj_argo-cd_v3 | >= 3.2.0 < 3.2.11 | 3.2.11 |
| github.com | argoproj_argo-cd_v3 | >= 3.3.0 < 3.3.9 | 3.3.9 |
| odf4 | odf-multicluster-rhel9-operator | — | — |
| openshift-gitops-1 | argocd-agent-rhel8 | — | — |
| openshift-gitops-1 | argocd-agent-rhel9 | — | — |
| openshift-gitops-1 | argocd-image-updater-rhel8 | — | — |
| openshift-gitops-1 | argocd-image-updater-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9_1776942799 | — | — |
| openshift-gitops-1 | gitops-rhel8 | — | — |
| openshift-gitops-1 | gitops-rhel8-operator | — | — |
| openshift-gitops-1 | gitops-rhel9 | — | — |
| openshift-gitops-1 | gitops-rhel9-operator | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthorized or anomalous requests to the Argo CD ServerSideDiff endpoint, particularly from accounts with only read-only access, as this endpoint is the attack surface for secret extraction. ↗
- →Alert on Server-Side Apply dry-run API calls to the Kubernetes API server originating from Argo CD service accounts with read-only roles, which may indicate exploitation of CVE-2026-42880. ↗
- →Detect Argo CD deployments running versions 3.2.0–3.2.10 or 3.3.0–3.3.8, which are vulnerable; flag these for immediate patching to 3.2.11 or 3.3.9. ↗
- ·The vulnerability exists specifically in the ServerSideDiff endpoint; patched versions are 3.2.11 and 3.3.9. Affected version ranges are 3.2.0–3.2.10 and 3.3.0–3.3.8. ↗
- ·Red Hat products including Red Hat OpenShift GitOps and ODF multicluster operator are confirmed affected, and no mitigation meeting Red Hat's criteria is currently available for those packages. ↗
- ·This CVE is part of a broader pattern of Argo CD internal surface exposures; defenders should also review CVE-2025-55190 (Git credential disclosure via read-only token) and CVE-2024-31989 (Redis cache poisoning) as related attack chains. ↗
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
ghsa·2026-05-07
CVE-2026-42880 [CRITICAL] CWE-200 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
### Summary
There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism.
### Details
Argo CD masks Secret data in every endpoint that returns Kubernetes resource state except one. All the other endpoints such as GetManifests, GetManifestsWithFiles, GetResource and PatchResource utilize hideSecretData() to mask the returned secret value. The vulnerable function ServerSideDiff gRPC/REST endpoint (/application.ApplicationService/ServerSideDiff) constructs its response with raw, unmasked PredictedLive and NormalizedLive states:
Red Hat
argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
vendor_redhat·2026-05-07·CVSS 9.6
CVE-2026-42880 [CRITICAL] CWE-201 argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: odf4/odf-
No detection rules found.
No public exploits indexed.
Hackernews
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
blogs_hackernews·2026-07-02
CVE-2024-31989 Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Argo CD , a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component's internal network port.
Synacktiv , which found the bug, says it can lead to a full cluster takeover. There is no fix and no CVE. The firm says it reported the flaw to Argo CD's maintainers in January 2025; roughly eighteen months later, it remains unpatched, so it published the details to warn users.
The bug sits in repo-server, the Argo
Bugzilla
CVE-2026-42880 argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
bugzilla·2026-05-07·CVSS 9.6
CVE-2026-42880 [CRITICAL] CVE-2026-42880 argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
CVE-2026-42880 argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3https://access.redhat.com/errata/RHBA-2026:12433https://access.redhat.com/errata/RHSA-2026:20943https://access.redhat.com/errata/RHSA-2026:20947https://access.redhat.com/security/cve/CVE-2026-42880https://bugzilla.redhat.com/show_bug.cgi?id=2467882https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json
2026-05-07
Published