{"id":"GO-2026-5099","revision":"ac098301d1584d068fc4f9c68aed30ad","records":[{"revision":"ac098301d1584d068fc4f9c68aed30ad","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5099","aliases":["BIT-argo-cd-2026-42880","CVE-2026-42880","CVE-2026-43824","GHSA-3v3m-wc6v-x4x3"],"title":"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd","description":"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-07-08T08:11:34.582856+00:00","affected":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.2.0"},{"kind":"fixed","version":"3.2.11"},{"kind":"introduced","version":"3.3.0"},{"kind":"fixed","version":"3.3.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","https://nvd.nist.gov/vuln/detail/CVE-2026-42880"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5099","license":"OSV · upstream source license applies","key":"osv:GO-2026-5099","identifiers":["GO-2026-5099","BIT-argo-cd-2026-42880","CVE-2026-42880","CVE-2026-43824","GHSA-3v3m-wc6v-x4x3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}