Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
References
| Link | Resource |
|---|---|
| https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 | Exploit Vendor Advisory |
| https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
11 May 2026, 17:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Argoproj
Argoproj argo Cd |
|
| CPE | cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* | |
| References | () https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 - Exploit, Vendor Advisory |
08 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 - |
07 May 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-07 23:16
Updated : 2026-05-11 17:46
NVD link : CVE-2026-42880
Mitre link : CVE-2026-42880
CVE.ORG link : CVE-2026-42880
JSON object : View
Products Affected
argoproj
- argo_cd