CVE-2026-42880

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42880", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-30T18:49:06.711Z", "datePublished": "2026-05-07T22:20:39.506Z", "dateUpdated": "2026-09-07T12:04:55.409Z"}, "containers": {"cna": {"title": "ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-212", "lang": "en", "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"}], "affected": [{"vendor": "argoproj", "product": "argo-cd", "versions": [{"version": ">= 3.2.0, < 3.2.11", "status": "affected"}, {"version": ">= 3.3.0, < 3.3.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T22:20:39.506Z"}, "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."}], "source": {"advisory": "GHSA-3v3m-wc6v-x4x3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-42880"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T03:56:28.920Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.19::el8"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-image-updater-rhel8", "product": "Red Hat OpenShift GitOps 1.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779211412", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776942799", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-agent-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779285564", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-image-updater-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779285074", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/gitops-rhel9-operator", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779284685", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/argocd-agent-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/argocd-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel9", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}], "datePublic": "2026-05-07T22:20:39.506Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-42880"}, {"name": "RHBZ#2467882", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467882"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20943"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20947"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHBA-2026:12433"}], "solutions": [{"lang": "en", "value": "RHSA-2026:20943: Red Hat OpenShift GitOps 1.19"}, {"lang": "en", "value": "RHSA-2026:20947: Red Hat OpenShift GitOps 1.20"}, {"lang": "en", "value": "RHBA-2026:12433: Red Hat OpenShift GitOps 1.20"}], "timeline": [{"lang": "en", "time": "2026-05-07T23:00:58.796Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-07T22:20:39.506Z", "value": "Made public."}], "title": "argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:55.409Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_gitops:1.19::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps 1.19", "versions": [{"status": "unaffected", "version": "1779211412", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-gitops-1/argocd-image-updater-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps 1.20", "versions": [{"status": "unaffected", "version": "1776942799", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-gitops-1/argocd-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps 1.20", "versions": [{"status": "unaffected", "version": "1779285564", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-gitops-1/argocd-agent-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps 1.20", "versions": [{"status": "unaffected", "version": "1779285074", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-gitops-1/argocd-image-updater-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps 1.20", "versions": [{"status": "unaffected", "version": "1779284685", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-gitops-1/gitops-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4", "packageName": "odf4/odf-multicluster-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/argocd-agent-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/argocd-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/gitops-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/gitops-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-07T23:00:58.796Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-07T22:20:39.506Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:20943: Red Hat OpenShift GitOps 1.19"}, {"lang": "en", "value": "RHSA-2026:20947: Red Hat OpenShift GitOps 1.20"}, {"lang": "en", "value": "RHBA-2026:12433: Red Hat OpenShift GitOps 1.20"}], "x_adpType": "supplier", "datePublic": "2026-05-07T22:20:39.506Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-42880", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467882", "name": "RHBZ#2467882", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20943", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20947", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHBA-2026:12433", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:55.409Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42880", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T13:06:33.203796Z"}}}], "references": [{"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T13:06:50.353Z"}}], "cna": {"title": "ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction", "source": {"advisory": "GHSA-3v3m-wc6v-x4x3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "argoproj", "product": "argo-cd", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.2.11"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.9"}]}], "references": [{"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3", "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-212", "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T22:20:39.506Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42880", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:04:55.409Z", "dateReserved": "2026-04-30T18:49:06.711Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T22:20:39.506Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "argo-cd", "vendor": "argoproj", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.2.11"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.9"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.19::el8"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-image-updater-rhel8", "product": "Red Hat OpenShift GitOps 1.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779211412", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776942799", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-agent-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779285564", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/argocd-image-updater-rhel9", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779285074", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_gitops:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-gitops-1/gitops-rhel9-operator", "product": "Red Hat OpenShift GitOps 1.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779284685", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/argocd-agent-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/argocd-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel8", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel8-operator", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "packageName": "openshift-gitops-1/gitops-rhel9", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D45D78D-37C6-4090-849B-BE4B9F873741", "versionEndExcluding": "3.2.11", "versionStartIncluding": "3.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A57863A-48B6-4926-87C7-6FBBE3E30A4B", "versionEndExcluding": "3.3.9", "versionStartIncluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."}, {"lang": "es", "value": "Argo CD es una herramienta de entrega continua declarativa, GitOps para Kubernetes. Desde las versiones 3.2.0 hasta antes de la 3.2.11 y de la 3.3.0 hasta antes de la 3.3.9, existe una brecha de autorizaci\u00f3n y enmascaramiento de datos faltante en el endpoint ServerSideDiff de Argo CD que permite a un atacante con acceso de solo lectura extraer datos de Secret de Kubernetes en texto plano de etcd a trav\u00e9s del mecanismo de simulaci\u00f3n (dry-run) de Aplicaci\u00f3n del Lado del Servidor (Server-Side Apply) del servidor API de Kubernetes. Este problema ha sido parcheado en las versiones 3.2.11 y 3.3.9."}], "id": "CVE-2026-42880", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42880", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-07T23:16:32.450", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHBA-2026:12433"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20943"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20947"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-42880"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467882"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42880.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-212"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-201"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHBA-2026:12433", "cpe": "cpe:/a:redhat:openshift_gitops:1.20::el9", "package": "openshift-gitops-1/argocd-rhel9:1776942799", "product_name": "Red Hat OpenShift GitOps 1.2", "release_date": "2026-04-30T00:00:00Z"}], "bugzilla": {"description": "argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism", "id": "2467882", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467882"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-201", "details": ["A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-42880", "package_state": [{"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "package_name": "odf4/odf-multicluster-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-agent-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-agent-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-image-updater-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-image-updater-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel8-operator", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel9-operator", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2026-05-07T22:20:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42880\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42880\nhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.0,3.2.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.3.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "argo-cd", "source": "cna", "vendor": "argoproj"}, "product": "argo-cd", "vendor": "argoproj"}], "created": "2026-05-07T23:30:40.150333+00:00", "updated": "2026-05-11T18:00:14.287960+00:00", "vendors": ["argoproj", "argoproj$PRODUCT$argo-cd"]}