CVE-2026-44973 vulnerabilities

Vulnerabilities for packages: telegraf, gitlab-rails-ce-fips, rclone, cerbos, packer-fips, rancher-fleet-fips, kyverno-fips, argo-cd, gitaly, chainloop-cli-fips, chainloop-cli, grafana-fips, seaweedfs-rocksdb-fips, seaweedfs-rocksdb, external-secrets-operator, flux, rancher-fleet, cerbos-fips,...

GHSA-QW64-3X98-G7Q2 vulnerabilities

Vulnerabilities for packages: telegraf, gitlab-rails-ce-fips, rclone, cerbos, packer-fips, rancher-fleet-fips, kyverno-fips, argo-cd, gitaly, chainloop-cli-fips, chainloop-cli, grafana-fips, seaweedfs-rocksdb-fips, seaweedfs-rocksdb, external-secrets-operator, flux, rancher-fleet, cerbos-fips,...

Information Disclosure

Argo CD is vulnerable to Information Exposure. The vulnerability is due to missing authorization and insufficient data masking in the ServerSideDiff endpoint, which allows an attacker with read-only access to extract plaintext Kubernetes Secret data through the Server-Side Apply dry-run mechanism...

CVE-2026-45738

creationtimestamp| type| source ---|---|--- 2026-05-13 17:59:47+00:00| published-proof-of-concept| https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38...

CVE-2026-45737

creationtimestamp| type| source ---|---|--- 2026-05-13 17:57:01+00:00| published-proof-of-concept| https://github.com/argoproj/argo-cd/security/advisories/GHSA-rg3g-4rw9-gqrp...

PT-2026-40844

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 3.2.12 Argo CD versions prior to 3.3.10 Argo CD versions prior to 3.4.2 Description A stored cross-site scripting XSS issue exists in the application Summary tab. A user with application write access developer role ca...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: bom, teleport, kargo, pulumi, tfsec, kyverno, pulumi-language-java, flux, external-secrets-operator, argocd-image-updater, terragrunt, guac, kots, melange, src-fingerprint, trivy, rancher-fleet, argo-events, kaniko, skaffold, wolfictl, pulumi-language-dotnet,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: apko-fips, gitsign, rancher-fleet-fips, flux-source-controller, gitaly-fips, trufflehog, coder, bom, flux, gitea, grype-db, kyverno, nemo, syft, grype-fips, terragrunt-fips, pulumi-kubernetes-operator, argo-workflows-fips, crossplane-fips, trufflehog-fips,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: apko-fips, gitsign, rancher-fleet-fips, flux-source-controller, gitaly-fips, trufflehog, coder, bom, flux, gitea, grype-db, kyverno, nemo, syft, grype-fips, terragrunt-fips, pulumi-kubernetes-operator, argo-workflows-fips, crossplane-fips, trufflehog-fips,...

CVE-2026-42880

A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the...

BIT-ARGO-CD-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880

CVE-2026-42880 (Argo CD) : A missing authorization/data-masking gap in Argo CD’s ServerSideDiff endpoint allows an attacker with read-only access to extract plaintext Secret data from etcd via the Kubernetes API server’s Server-Side Apply dry-run. Affected versions are 3.2.0–3.2.10 and 3.3.0–3.3....

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. Details Argo CD masks Secret...

GHSA-3V3M-WC6V-X4X3 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. Details Argo CD masks Secret...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: apko-fips, gitsign, rancher-fleet-fips, flux-source-controller, gitaly-fips, trufflehog, bom, flux, gitea, grype-db, kyverno, nemo, syft, grype-fips, commercial-chainloop-cli, terragrunt-fips, pulumi-kubernetes-operator, argo-workflows-fips, crossplane-fips,...

PT-2026-37356

Name of the Vulnerable Software and Affected Versions Argo CD versions 3.2.0 through 3.2.10 Argo CD versions 3.3.0 through 3.3.8 Description A missing authorization and data-masking gap exists in the '/application.ApplicationService/ServerSideDiff' endpoint. This allows an attacker with read-only...