CVE-2026-43824

Published: May 2, 2026Modified: Jul 15, 2026Deferred

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Exploitability: 3.1 / Impact: 5.8

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Description

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

Related CWEs

Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (5)

https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3

Source: cve@mitre.org

https://access.redhat.com/security/cve/CVE-2026-43824

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2464613

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.