Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-cd | >= 3.2.0, < 3.2.11, >= 3.3.0, < 3.3.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argocd-image-updater | 1.2.0-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
HAERIN-L/POC_CVE-2026-42880 ★ 0 · May 25, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-cd | all versions | — | GO-2026-5099 |
| Go | github.com/argoproj/argo-cd/v2 | all versions | — | GO-2026-5099 |
| Go | github.com/argoproj/argo-cd/v3 | >= 3.2.0, < 3.2.11 | 3.2.11 | GHSA-3v3m-wc6v-x4x3 |
| Go | github.com/argoproj/argo-cd/v3 | >= 3.3.0, < 3.3.9 | 3.3.9 | GHSA-3v3m-wc6v-x4x3 |
| Go | github.com/argoproj/argo-cd/v3 | >= 3.2.0, < 3.2.11 · >= 3.3.0, < 3.3.9 | 3.2.11, 3.3.9 | GO-2026-5099 |
Advisories 2
- WID-SEC-2026-1383 Argo CD: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 20, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026