CVE-2026-42880

A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the...

BIT-ARGO-CD-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

GHSA-3G76-F9XQ-8VP6 vulnerabilities

Vulnerabilities for packages: spark-fips, spark-kubernetes-operator, apache-camel-karavan-devmode, wildfly, keycloak-fips, keycloak, strimzi-kafka-operator, strimzi-kafka-operator-fips, apicurio-registry, apache-pulsar, request-9047-keycloak-fips, knative-kafka-broker-fips, spark,...

CVE-2026-6860 vulnerabilities

Vulnerabilities for packages: spark-fips, spark-kubernetes-operator, apache-camel-karavan-devmode, wildfly, keycloak-fips, keycloak, strimzi-kafka-operator, strimzi-kafka-operator-fips, apicurio-registry, apache-pulsar, request-9047-keycloak-fips, knative-kafka-broker-fips, spark,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: dask-gateway, argo-cd, libnvidia-container, aactl, k8s-device-plugin, knative-eventing, nerdctl, zot, mattermost, kubernetes, prometheus, istio, k3s, telegraf, trino, grafana, go, cilium-cli, helm, kubevela, kyverno, kubernetes-csi-node-driver-registrar, zarf, cilium...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: terragrunt-fips, authentik, beats-fips, reports-server, net-kourier-fips, karpenter, datadog-agent-fips, knative-operator-fips, knative-serving-fips, cluster-autoscaler, prometheus-elasticsearch-exporter, consul, vitess, zabbix-agent2, kubevirt-cdi-uploadproxy-fips,...

GHSA-XQ5J-9R39-C3VF vulnerabilities

Vulnerabilities for packages: mapotf-fips, crossplane-provider-aws-sesv2-fips, porch, net-kourier-fips, karpenter, opencost-fips, knative-operator-fips, crossplane-provider-aws-rolesanywhere, helm-operator-fips, cert-manager, trivy-operator-fips, cloudbeat-fips, jfrog-cli,...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

EUVD-2026-28894

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

EUVD-2026-28895

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

GHSA-497X-JCXF-M478 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sesv2-fips, terraform-provider-random-fips, eks-node-monitoring-agent-fips, kiali-fips, nova-fips, kubernetes-csi-livenessprobe, net-kourier-fips, goose-fips, karpenter, opencost-fips, knative-operator-fips, cloudnative-pg-fips,...

CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: mapotf-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-random-fips, porch, kyverno-policy-reporter-kyverno-plugin-fips, eks-node-monitoring-agent-fips, kiali-fips, kube-logging-operator-custom-runner-fips, kubernetes-csi-livenessprobe, go-fips, hclgrep,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: mapotf-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-random-fips, porch, kyverno-policy-reporter-kyverno-plugin-fips, eks-node-monitoring-agent-fips, kiali-fips, kube-logging-operator-custom-runner-fips, kubernetes-csi-livenessprobe, go-fips, hclgrep,...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: mapotf-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-random-fips, porch, kyverno-policy-reporter-kyverno-plugin-fips, eks-node-monitoring-agent-fips, kiali-fips, kube-logging-operator-custom-runner-fips, kubernetes-csi-livenessprobe, go-fips, hclgrep,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: mapotf-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-random-fips, porch, kyverno-policy-reporter-kyverno-plugin-fips, eks-node-monitoring-agent-fips, kiali-fips, kube-logging-operator-custom-runner-fips, kubernetes-csi-livenessprobe, go-fips, hclgrep,...