CVE-2026-42880: Argo CD information disclosure in ServerSideDiff endpoint

CVE-2026-42880 · Severity: critical · CVSS 9.6 · Published 2026-05-07

Argo CD, a tool used to automate the deployment of applications to Kubernetes, contains a vulnerability that could allow an attacker to steal sensitive credentials. By exploiting a flaw in how the system compares different versions of application configurations, a user with basic read-only access can bypass security protections to view plaintext secrets, such as passwords or API keys. This could lead to unauthorized access to other parts of the corporate infrastructure or sensitive data stored in the Kubernetes environment.

Technologies: Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go), github.com/argoproj/argo-cd/v3 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-42880 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42880 being exploited in the wild.
How severe is CVE-2026-42880?
Critical severity, with a CVSS score of 9.6, published 7 May 2026.
Which products and versions are affected?
Argo Project Argo CD >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9, 3.2.0 to 3.2.10, 3.3.0 to 3.3.8; github.com/argoproj/argo-cd (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v3 (Go) SEMVER:introduced=3.2.0,fixed=3.2.11, SEMVER:introduced=3.2.0,fixed=3.2.11,introduced=3.3.0,fixed=3.3.9.
Is there a fix for CVE-2026-42880?
Yes. github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.11, 3.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42880 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42880?
Check whether you run Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.11, 3.3.9 or later
    go get github.com/argoproj/argo-cd/v3@v3.3.9

Technical details

A vulnerability exists in the Argo CD ServerSideDiff gRPC/REST endpoint due to missing authorization checks and a failure to mask sensitive data. The endpoint utilizes the Kubernetes API server's Server-Side Apply (SSA) dry-run mechanism to calculate differences between resource states. While Argo CD typically employs a defense layer to strip non-managed fields and mask secrets, this protection is bypassed when the application is configured with the 'IncludeMutationWebhook=true' annotation. An authenticated attacker with read-only permissions can invoke this endpoint to receive raw, unmasked secret values from etcd. The issue is patched in Argo CD versions 3.2.11 and 3.3.9.

Affected products

  • argoproj Argo CD 3.2.0 to 3.2.10, 3.3.0 to 3.3.8
  • Red Hat Red Hat OpenShift GitOps 1.19, 1.20

Identifiers

  • CVE-2026-42880
  • GHSA-3v3m-wc6v-x4x3
  • GO-2026-5099

Timeline

  • 2026-04-30: patched: Red Hat released initial bug fix advisory
  • 2026-05-01: advisory: GitHub Security Advisory published by maintainers
  • 2026-05-07: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.