CVE-2026-42880 is a critical vulnerability in Argo CD's ServerSideDiff endpoint that allows attackers with read-only access to extract plaintext Kubernetes Secret data. The issue arises because the ServerSideDiff endpoint returns unmasked secret data from the Kubernetes API server's Server-Side Apply dry-run response when a specific annotation is set, bypassing the usual masking defenses. This can expose sensitive secret information stored in etcd. The vulnerability affects Argo CD versions 3.2.0 through 3.2.10 and 3.3.0 through 3.3.8 and is fixed in versions 3.2.11 and 3.3.9.