Quick heads-up on
CVE-2026-42880 (Argo CD).
What it is: a read-only user can extract plaintext Kubernetes Secrets through the ServerSideDiff endpoint. CVSS 9.6. Disclosed May 7, 2026 by researcher
Hoang-Prod.
How it works: the endpoint relies on a defense layer called removeWebhookMutation to strip sensitive fields from Server-Side Apply dry-run responses. That defense is skipped when an application has the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true. With the annotation set, the dry-run returns raw etcd data, including service account tokens, database credentials, API keys, and TLS certs.
Who is affected: Argo CD 3.2.0 to 3.2.10 and 3.3.0 to 3.3.8, AND at least one application using the IncludeMutationWebhook annotation. A PoC Python script already exists.
Fix: upgrade to 3.2.11 or 3.3.9.
If you cannot upgrade today: audit your applications for the IncludeMutationWebhook annotation and remove it from any application that does not strictly need it.
Have a great week,
Aymen