Critical Argo CD Vulnerability Enables Kubernetes Secret Extraction

A critical Argo CD vulnerability (CVE-2026-42880, CVSS 9.6) in the ServerSideDiff endpoint can expose unmasked Kubernetes Secrets from etcd when Server-Side Apply dry-run responses are returned raw—affecting Argo CD versions 3.2.0 through 3.3.8; maintainers released patches (3.3.9 and 3.2.11) and recommend immediate upgrades, configuration audits, and temporary access restrictions while remediating. A proof-of-concept Python script demonstrates automated secret extraction, and the flaw requires only minimal privileges to exploit, enabling potential cluster-wide credential compromise and lateral movement.