Skip to content
OpenAdvisories
High WID-SEC-2026-1383 2 CVEs

Argo CD: Schwachstelle ermöglicht Offenlegung von Informationen

Published May 5, 2026 · Updated Oct 20, 2026 · Revision 3 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Argo CD ausnutzen, um Informationen offenzulegen.

Product

Open Source Argo CD ist ein deklaratives, GitOps-basiertes Continuous-Delivery-Tool für Kubernetes.

Vulnerabilities 2

  • Critical 9.9
    CVE-2026-113672

    Argo CD: A Jsonnet import can read files from the repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository …

    argoproj Argo CD
  • Critical 9.6
    CVE-2026-42880 Public exploit

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with r…

    argoproj Argo CD argocd-image-updater github.com/argoproj/argo-cd Wolfi Go

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-113672, EUVD-2026-105227

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-28469

  3. #1

    Initiale Fassung

References