VDB
RHBA-2026%3A12433
RHBA-2026%3A12433
PUBLISHED
CVSS 7.699999809265137 HIGH
A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x as a component of Red Hat OpenShift GitOps 1.2 | *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64 |
…and 21 more
Timeline
- Apr 30, 2026 CVE Published
- May 11, 2026 Security Advisory
- May 11, 2026 Security Advisory
- May 15, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHBA-2026:12433 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_12433.json advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42880 advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 advisory
- https://access.redhat.com/security/cve/CVE-2026-42880 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467882 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42880 advisory