Beveiligingsadvies

CVE-2026-42880

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-07 22:20:39

Laatst bijgewerkt 2026-09-07 12:04:55

Toegewezen door GitHub_M

CVSS-score 9.6

Status PUBLISHED

Beschrijving

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

← Alle CVE's bekijken Bekijk op cve.org ↗