Critical Argo CD Vulnerability (CVE-2026-42880) Exposes Kubernetes Secrets via etcd A severe vulnerability in Argo CD, tracked as CVE-2026-42880 (CVSS 9.6), allows attackers with minimal privileges to extract highly sensitive Kubernetes Secrets directly from etcd clusters. Discovered by security researcher Hoang-Prod and disclosed via a GitHub security advisory, the flaw stems from a missing authorization and data-masking gap in the platform’s ServerSideDiff endpoint. ### How the Flaw Works The vulnerability arises when Argo CD’s ServerSideDiff gRPC and REST endpoints fail to apply data-masking protocols consistently. While other endpoints (e.g., GetManifests, PatchResource) invoke a function (removeWebhookMutation) to conceal secrets, the ServerSideDiff endpoint returns raw, unmasked data from the cluster when certain configurations are present. The issue is triggered when an Argo CD application includes the compare-options annotation with mutation webhooks enabled, bypassing the defense layer that normally strips sensitive fields. This exposes etcd-stored secrets, including: - Service account tokens - Database credentials - API keys - TLS certificates ### Exploitation & Impact Exploiting CVE-2026-42880 requires low technical skill, as a proof-of-concept Python script has already been demonstrated to automate secret extraction. The script: 1. Fetches managed resources. 2. Identifies secrets. 3. Forces the ServerSideDiff endpoint to reveal unmasked data via grpc-web. Once extracted, these credentials enable lateral movement across Kubernetes clusters, compromising confidentiality and integrity at scale. ### Affected Versions & Remediation The vulnerability impacts Argo CD versions 3.2.0 through 3.3.8. Maintainers have released patched versions (3.3.9, 3.2.11), which enforce correct data masking regardless of webhook settings. Recommended actions: - Upgrade immediately to 3.3.9 or 3.2.11. - Audit configurations for applications using compare-options with mutation webhooks. - Restrict ServerSideDiff access and monitor API traffic for anomalous secret-related requests until patching is complete. Failure to address this flaw risks unauthorized access to critical Kubernetes infrastructure.

A critical Cross-Site Scripting (XSS) vulnerability has been discovered in Argo CD, a popular GitOps continuous delivery tool for Kubernetes. This vulnerability, designated as CVE-2025-47933, allows attackers with edit permissions to inject malicious JavaScript into repository links. When administrators click these links, the malicious scripts execute, enabling unauthorized actions such as creating, modifying, and deleting Kubernetes resources. The vulnerability affects versions from 1.2.0-rc1 up to recently patched versions v3.0.4, v2.14.13, and v2.13.8. The CVSS base score is 9.1, indicating a critical risk.