What is the CVSS score of CVE-2026-43824?

CVE-2026-43824 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Argo CD are affected by CVE-2026-43824?

Argo CD versions 3.2.0-3.2.10 and 3.3.0-3.3.8 contain an authenticated privilege escalation vulnerability that exposes cleartext Kubernetes Secrets (database passwords, API tokens, certificates) to…. A patch is available.

How to fix or mitigate CVE-2026-43824?

Within 24 hours: Identify all Argo CD instances and document current versions using `argocd version`. Restrict network access to Argo CD APIs and UI to administrative personnel only. Within 7 days: Audit Kubernetes Secret access logs for unauthorized read attempts. Review all low-privileged user accounts and disable unnecessary ones. Within 30 days: Upgrade Argo CD to version 3.2.11+ or 3.3.9+ as vendor releases patches; if upgrades are blocked, implement Pod Security Policies to deny Secret enumeration and rotate all exposed credentials (database passwords, API tokens, certificates) stored in Kubernetes Secrets.

Argo CD CVE-2026-43824

EUVD-2026-26726 HIGH

Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)

2026-05-02 mitre

Information Disclosure Kubernetes Argo Cd

7.7

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

May 04, 2026 - 14:16 nvd

Patch available

May 02, 2026 - 03:01 EUVD

Analysis Generated

May 02, 2026 - 02:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 02:00 euvd

EUVD-2026-26726

Analysis Generated

May 02, 2026 - 02:00 vuln.today

CVE Published

May 02, 2026 - 01:20 nvd

HIGH 7.7

DescriptionCVE.org

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

AnalysisAI

Authenticated users with low privileges can read cleartext Kubernetes Secret data through Argo CD's ServerSideDiff feature in versions 3.2.0-3.2.10 and 3.3.0-3.3.8. This scope-changing vulnerability (CVSS:3.1 S:C) allows attackers to access sensitive credential data managed by Kubernetes, including database passwords, API tokens, and certificates, by exploiting the server-side diff functionality. With a 7.7 CVSS score and low attack complexity (AC:L), this represents a significant confidentiality breach requiring only network access and basic authentication-no public exploit identified at time of analysis, but the technical barrier to exploitation is minimal.

Technical ContextAI

Argo CD is a declarative GitOps continuous delivery tool for Kubernetes. The ServerSideDiff feature compares desired application state with live cluster state to detect configuration drift. The vulnerability (CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer) occurs when this diff operation exposes cleartext Kubernetes Secret resources instead of properly redacting or masking sensitive data fields. Kubernetes Secrets are intended to store sensitive information like passwords, OAuth tokens, and SSH keys in base64-encoded (not encrypted) form. Argo CD's diff functionality should sanitize these values before returning comparison results to users, but affected versions fail to do so. The Changed Scope (S:C) in the CVSS vector indicates the vulnerability impacts resources beyond Argo CD's own security boundary-specifically, it breaches the confidentiality of Kubernetes cluster secrets that should be protected by separate RBAC policies.

RemediationAI

Upgrade immediately to Argo CD version 3.2.11 or later for the 3.2.x branch, or version 3.3.9 or later for the 3.3.x branch, as indicated by the CVE description's 'before' version ranges. Consult the official GitHub Security Advisory at https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 for complete remediation guidance and release notes. If immediate patching is not feasible, implement compensating controls: restrict Argo CD user permissions using RBAC to limit which applications users can view or diff (trade-off: reduces operational flexibility and may require creating additional service accounts for legitimate diff operations); disable ServerSideDiff functionality entirely if your deployment workflow doesn't require live cluster comparisons (trade-off: loses drift detection capability, requiring manual inspection); audit existing Argo CD access logs for suspicious diff operations against applications containing Secrets to identify potential prior exploitation; rotate any Kubernetes secrets that may have been exposed to unauthorized users. Note that access restriction mitigations only reduce attack surface-they do not fix the underlying information disclosure flaw, so upgrading remains the definitive solution.