Argo CD, a GitOps continuous delivery tool for Kubernetes, had a vulnerability in its ServerSideDiff endpoint that lacked proper authorization and data masking controls. This flaw allowed attackers with read-only permissions to retrieve plaintext Kubernetes Secret data stored in etcd by exploiting the Kubernetes API server's Server-Side Apply dry-run feature. The vulnerability affects Argo CD versions from 3.2.0 up to but not including 3.2.11, and from 3.3.0 up to but not including 3.3.9. The vulnerability is tracked as CVE-2026-42880 with a CVSS 3.1 score of 9.6, indicating critical severity. Official patches addressing this issue were released in versions 3.2.11 and 3.3.9.

An attacker with read-only access to Argo CD could exploit this vulnerability to extract plaintext Kubernetes Secret data, leading to exposure of sensitive information. This compromises confidentiality and could facilitate further attacks or unauthorized access within the Kubernetes environment. The vulnerability does not impact integrity or availability directly but poses a critical confidentiality risk.

This vulnerability has been officially patched in Argo CD versions 3.2.11 and 3.3.9. Users should upgrade to one of these versions or later to remediate the issue. Since this is not a cloud service, patching the affected software is required to mitigate the risk. Patch status is confirmed by the vendor advisory indicating the fix is available in these versions.