Dashboard / CVE-2026-42880

CVE-2026-42880

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-05-07 Modified: 2026-10-26 First seen: 2026-10-29 Status: pending_score

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

Weakness Classification (3)

Affected Software (2)

VendorProductVersion
argoproj argo_cd 3.2.0 – 3.2.11
argoproj argo_cd 3.3.0 – 3.3.9

References & Advisories (7)

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.65%
Raw Score 0.006450
Percentile 50.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00645
2026-10-28
0.00645

Intelligence Sources

nvd ref →

External Links