CVE-2026-42880 is a critical vulnerability in argoproj's argo-cd, affecting versions >=3.2.0 <3.2.11 and >=3.3.0 <3.3.9. The vulnerability arises from a missing authorization and data-masking gap in the ServerSideDiff endpoint, which allows an attacker with read-only privileges to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This exposure of sensitive information (CWE-200) can lead to a complete confidentiality breach of Kubernetes secrets. The vulnerability has been patched in versions 3.2.11 and 3.3.9. Red Hat advisories confirm the issue and provide updates for affected products.

An attacker with read-only access to the Argo CD ServerSideDiff endpoint can extract plaintext Kubernetes Secret data, leading to a complete confidentiality compromise of sensitive Kubernetes secrets. This can undermine the security of Kubernetes clusters managed by Argo CD, potentially exposing credentials, tokens, or other sensitive configuration data. The vulnerability does not impact integrity or availability directly but has a critical impact on confidentiality.

This vulnerability has been officially patched in Argo CD versions 3.2.11 and 3.3.9. Users should upgrade affected versions to these or later versions to remediate the issue. Refer to the Red Hat advisories for detailed update instructions: https://access.redhat.com/security/cve/CVE-2026-42880 and associated errata. No additional mitigations are required once patched.