Kritik CVSS 9.6 PoC var
CVE-2026-42880: Argo Cd: hassas bilgi ifşası
Açıklama (NVD)
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.
Özet bilgiler
- Ürün
- Argoproj Argo Cd
- CVSS v3.1
- 9.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - EPSS
- %0,65 (yüzdelik 51)
- CWE
- CWE-200
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| argoproj-argo-cd | 3.2.0 | — | 3.2.11 |
| argoproj-argo-cd | 3.3.0 | — | 3.3.9 |