Descrição
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD-s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server-s Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
CVSS 9.6EPSS 0.506%Risco 1
Ver fonte- Publicação
- 2026-05-07 23:16:32
- Versões afetadas
- <3.2.11,>=3.2.0,<3.3.9,>=3.3.0
- Tipo
- Package
- Última alteração
- 2026-08-11 13:18:52
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N