CVE-2026-42880: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in argoproj argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
AI Analysis
Technical Summary
CVE-2026-42880 is a security flaw in Argo CD, part of Red Hat OpenShift GitOps, where a missing authorization and data-masking gap in the ServerSideDiff endpoint permits an attacker with read-only access to extract sensitive Kubernetes Secret information. The vulnerability exploits the Kubernetes API server's Server-Side Apply dry-run feature to disclose critical configuration and credentials. Red Hat has released OpenShift GitOps v1.20.3 as a bug fix and enhancement update to remediate this issue. The vulnerability is tracked under CWE-201, CWE-200, and CWE-212, indicating insertion and exposure of sensitive information. No known exploits are reported in the wild.
Potential Impact
The vulnerability allows unauthorized disclosure of sensitive Kubernetes Secret data to attackers who have read-only access to the affected Argo CD ServerSideDiff endpoint. This could lead to exposure of critical configuration and credentials, potentially compromising the security of Kubernetes clusters managed by OpenShift GitOps prior to version 1.20.3.
Mitigation Recommendations
A fix is available in Red Hat OpenShift GitOps version 1.20.3. Users should apply this update to remediate the vulnerability. Before updating, ensure all previously released errata relevant to your system have been applied. No alternative mitigations meeting Red Hat's criteria are currently available. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258.
CVE-2026-42880: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in argoproj argo-cd
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
CVSS v3.1
Score 9.6critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42880 is a security flaw in Argo CD, part of Red Hat OpenShift GitOps, where a missing authorization and data-masking gap in the ServerSideDiff endpoint permits an attacker with read-only access to extract sensitive Kubernetes Secret information. The vulnerability exploits the Kubernetes API server's Server-Side Apply dry-run feature to disclose critical configuration and credentials. Red Hat has released OpenShift GitOps v1.20.3 as a bug fix and enhancement update to remediate this issue. The vulnerability is tracked under CWE-201, CWE-200, and CWE-212, indicating insertion and exposure of sensitive information. No known exploits are reported in the wild.
Potential Impact
The vulnerability allows unauthorized disclosure of sensitive Kubernetes Secret data to attackers who have read-only access to the affected Argo CD ServerSideDiff endpoint. This could lead to exposure of critical configuration and credentials, potentially compromising the security of Kubernetes clusters managed by OpenShift GitOps prior to version 1.20.3.
Mitigation Recommendations
A fix is available in Red Hat OpenShift GitOps version 1.20.3. Users should apply this update to remediate the vulnerability. Before updating, ensure all previously released errata relevant to your system have been applied. No alternative mitigations meeting Red Hat's criteria are currently available. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHBA-2026:12433
- Cve Count
- 1
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a16096de29bf47b50634e4e
Added to database: 05/26/2026, 20:58:21 UTC
Last enriched: 08/16/2026, 18:22:59 UTC
Last updated: 09/13/2026, 10:01:31 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.