9.6

CVE-2026-42880

Medienbericht
Exploit

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Argoproj ≫ Argo Cd Version >= 3.2.0 < 3.2.11
Argoproj ≫ Argo Cd Version >= 3.3.0 < 3.3.9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.393
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 9.6 3.1 5.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.07.2026 22:14
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
Vendor Advisory
Exploit
https://access.redhat.com/errata/RHSA-2026:20943
https://access.redhat.com/errata/RHBA-2026:12433
https://access.redhat.com/errata/RHSA-2026:20947
https://access.redhat.com/security/cve/CVE-2026-42880
https://bugzilla.redhat.com/show_bug.cgi?id=2467882
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json