Vulnerability · Published May 2, 2026 · Assigned by mitre
CVE-2026-43824
High 7.7
In plain English
A high-severity security flaw in Argo CD from argoproj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix listed | GO-2026-5099 |
| Go | github.com/argoproj/argo-cd/v2 | no fix listed | GO-2026-5099 |
| Go | github.com/argoproj/argo-cd/v3 | 3.2.11 | GHSA-3v3m-wc6v-x4x3 |
| Go | github.com/argoproj/argo-cd/v3 | 3.3.9 | GHSA-3v3m-wc6v-x4x3 |
| Go | github.com/argoproj/argo-cd/v3 | 3.2.11, 3.3.9 | GO-2026-5099 |
Affected products (as reported)
Weakness: CWE-212, CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
- https://access.redhat.com/security/cve/CVE-2026-43824 vdb-entry, x_refsource_REDHAT
- RHBZ#2464613 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json x_sadp-csaf-vex