# CVE-2026-42880: Argo CD information disclosure in ServerSideDiff endpoint

Source: https://junglewise.ai/threats/cve-2026-42880-argo-cd-information-disclosure-in-serversidediff-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-42880 · Severity: critical · CVSS 9.6 · Published 2026-05-07

Argo CD, a tool used to automate the deployment of applications to Kubernetes, contains a vulnerability that could allow an attacker to steal sensitive credentials. By exploiting a flaw in how the system compares different versions of application configurations, a user with basic read-only access can bypass security protections to view plaintext secrets, such as passwords or API keys. This could lead to unauthorized access to other parts of the corporate infrastructure or sensitive data stored in the Kubernetes environment.

Technologies: [Argo Project Argo CD](https://junglewise.ai/threats/technologies/argo-cd), [github.com/argoproj/argo-cd (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-cd), [github.com/argoproj/argo-cd/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-cd-v2), [github.com/argoproj/argo-cd/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-argoproj-argo-cd-v3). Vendors: [Argo Project](https://junglewise.ai/threats/vendors/argo-project), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42880 being exploited in the wild.

**How severe is CVE-2026-42880?** Critical severity, with a CVSS score of 9.6, published 7 May 2026.

**Which products and versions are affected?** Argo Project Argo CD >= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.9, 3.2.0 to 3.2.10, 3.3.0 to 3.3.8; github.com/argoproj/argo-cd (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v2 (Go) SEMVER:introduced=0; github.com/argoproj/argo-cd/v3 (Go) SEMVER:introduced=3.2.0,fixed=3.2.11, SEMVER:introduced=3.2.0,fixed=3.2.11,introduced=3.3.0,fixed=3.3.9.

**Is there a fix for CVE-2026-42880?** Yes. github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.11, 3.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42880 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42880?** Check whether you run Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.11, 3.3.9 or later

  ```sh
  go get github.com/argoproj/argo-cd/v3@v3.3.9
  ```


## Technical details

A vulnerability exists in the Argo CD ServerSideDiff gRPC/REST endpoint due to missing authorization checks and a failure to mask sensitive data. The endpoint utilizes the Kubernetes API server's Server-Side Apply (SSA) dry-run mechanism to calculate differences between resource states. While Argo CD typically employs a defense layer to strip non-managed fields and mask secrets, this protection is bypassed when the application is configured with the 'IncludeMutationWebhook=true' annotation. An authenticated attacker with read-only permissions can invoke this endpoint to receive raw, unmasked secret values from etcd. The issue is patched in Argo CD versions 3.2.11 and 3.3.9.

## Affected products

- argoproj Argo CD 3.2.0 to 3.2.10, 3.3.0 to 3.3.8
- Red Hat Red Hat OpenShift GitOps 1.19, 1.20

## Identifiers

- CVE-2026-42880
- GHSA-3v3m-wc6v-x4x3
- GO-2026-5099

## Timeline

- 2026-04-30: patched: Red Hat released initial bug fix advisory
- 2026-05-01: advisory: GitHub Security Advisory published by maintainers
- 2026-05-07: disclosed: NVD publication date

## References

- [https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3](https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3)
- [https://access.redhat.com/errata/RHBA-2026:12433](https://access.redhat.com/errata/RHBA-2026:12433)
- [https://access.redhat.com/errata/RHSA-2026:20943](https://access.redhat.com/errata/RHSA-2026:20943)
- [https://access.redhat.com/errata/RHSA-2026:20947](https://access.redhat.com/errata/RHSA-2026:20947)
- [https://access.redhat.com/security/cve/CVE-2026-42880](https://access.redhat.com/security/cve/CVE-2026-42880)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2467882](https://bugzilla.redhat.com/show_bug.cgi?id=2467882)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json)

## Related threats

- [Argo CD arbitrary code execution via Helm plugin download in Kustomize](https://junglewise.ai/threats/cve-2026-113709-argo-cd-is-a-declarative-gitops-continuous-delivery-tool-for)
- [Argo CD AppProject destination and resource restrictions bypass in PreDelete/PostDelete hooks](https://junglewise.ai/threats/cve-2026-77459-argo-cd-appproject-destination-namespace-and-resource)
- [Argo CD repo-server command injection via SSH proxy URL](https://junglewise.ai/threats/cve-2026-55797-argo-cd-repo-server-command-injection-via-crafted-ssh-repository)
- [Argo CD stored XSS in application link annotations](https://junglewise.ai/threats/cve-2026-45738-argo-cd-stored-xss-in-application-link-annotations)
- [Argo CD information exposure in ServerSideDiff](https://junglewise.ai/threats/cve-2026-45737-argo-cd-information-exposure-in-serversidediff)