{"id":"EUVD-2026-28469","revision":"d35f5fb84ddf463697d2535f7a3a4de0","records":[{"revision":"d35f5fb84ddf463697d2535f7a3a4de0","observedAt":"2026-11-01T07:15:10.19+00:00","statement":{"source":"euvd","id":"EUVD-2026-28469","aliases":["CVE-2026-42880","GHSA-3v3m-wc6v-x4x3"],"title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows…","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":9.6,"severity":null}],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28469","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 10:20:39 PM","dateUpdated":"Sep 7, 2026, 12:04:55 PM"},"relatedAdvisories":[{"id":"RHSA-2026:20943","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.4 security update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-32281","CVE-2026-33186","CVE-2026-33487","CVE-2026-42880"]},{"id":"RHBA-2026:12433","title":"Red Hat Bug Fix Advisory: Red Hat OpenShift GitOps v1.20.3 bug fix and enhancement update","vulnerabilityIds":["CVE-2026-42880"]},{"id":"RHSA-2026:20947","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.4 security update","vulnerabilityIds":["CVE-2026-32281","CVE-2026-32282","CVE-2026-42880"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28469","identifiers":["EUVD-2026-28469","CVE-2026-42880","GHSA-3v3m-wc6v-x4x3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}