{"id":"CVE-2026-43824","published":"2026-05-02T01:20:33Z","modified":"2026-07-15T00:55:34Z","title":"In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data","vendor":"argoproj","product":"Argo CD","tier":"tail","description":{"text":"In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00268,"percentile":0.18978,"provenance":"source"},"cwes":[{"id":"CWE-212","name":"Improper Removal of Sensitive Information Before Storage or Transfer"},{"id":"CWE-312","name":"Cleartext Storage of Sensitive Information"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43824","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464613","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json","tags":["x_sadp-csaf-vex"]}],"priority":{"score":9.2,"factors":[{"name":"EPSS percentile","points":3.8},{"name":"CVSS severity","points":5.39}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"Argo CD","versions":[">= 3.2.0, < 3.2.11",">= 3.3.0, < 3.3.9"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2026-5099"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2026-5099"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v3","vulnerableRanges":[">=3.2.0, <3.2.11",">=3.3.0, <3.3.9"],"patched":["3.2.11","3.3.9"],"from":["GO-2026-5099"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-26726","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2022-24904","children":[{"from":"CVE-2026-43824","to":"CVE-2026-113672","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-3v3m-wc6v-x4x3","via":"related"}]},{"from":"CVE-2026-43824","to":"CVE-2026-42880","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-3v3m-wc6v-x4x3","via":"reference","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same product + CWE + description similarity"}]}]}}