← Vulnerability feed

Vulnerability record · CVE-2026-42880 · published 7 May 2026

CVE-2026-42880: Argoproj argo cd information exposure vulnerability

Argoproj · Argo Cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

9.6 CVSS 3.1 Critical EPSS 0.56% · top 55.3% CWE-200 · Information exposureCWE-212 · CWE-212
9.6CVSS 3.1 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
7 Sep 2026Last modified by NVD

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 ExploitVendor Advisory
https://access.redhat.com/errata/RHBA-2026:12433
https://access.redhat.com/errata/RHSA-2026:20943
https://access.redhat.com/errata/RHSA-2026:20947
https://access.redhat.com/security/cve/CVE-2026-42880
https://bugzilla.redhat.com/show_bug.cgi?id=2467882
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 ExploitVendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json

Track CVE-2026-42880 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-29165Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with versi…EPSS 2.1%9.9CVE-2025-55190Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.…EPSS 5.5%9.8CVE-2024-21652Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chai…EPSS 0.75%9.6CVE-2023-40029Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. …EPSS 1.2%9.6CVE-2022-31105Argoproj argo cd improper certificate validation vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 i…EPSS 0.78%9.1CVE-2024-21662Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively by…EPSS 0.84%9.0CVE-2024-31989Argoproj argo cd broken cryptographic algorithm vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on…EPSS 1.5%8.8CVE-2023-22482Argoproj argo cd incorrect authorization vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6…EPSS 0.88%

Source: NIST National Vulnerability Database (record CVE-2026-42880), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.