Argo CD: read-only users can extract plaintext Kubernetes Secret data via ServerSideDiff

Impact

Argo CD's ServerSideDiff endpoint misses an authorization check and a data-masking step, so a user with nothing but read access round-trips a Secret through the API server's server-side apply dry-run and reads the plaintext back. Read-only Argo access is the level handed out broadly - to developers, to platform teams, to anyone who wants to see sync status - while Argo itself usually holds cluster-wide privileges to sync manifests everywhere. On a GPU cluster that means registry pull secrets, object store and model registry credentials, cloud keys and scheduler tokens all become readable by an account that was never meant to see them. Scored 9.6 with a scope change.

Who can reach it

An authenticated Argo CD user with read-only permission on at least one application, with network reach to the Argo CD API or UI. No admin role and no direct Kubernetes API access needed.

What to do

Upgrade Argo CD to 3.2.11 or 3.3.9; on OpenShift GitOps take RHSA-2026:20943 / RHSA-2026:20947. That is a rolling restart of the argocd-server deployment - no node drain, no GPU workload impact. Then rotate the Secrets that read-only users could have pulled, since the endpoint leaves no distinguishing trace in normal Argo audit output.

References

Related entries

• Kata Containers: kata-runtime host code execution via an untrusted input pathCVE-2026-50540 · Kata ContainersCritical
• Kyverno: namespaced mutating policy can generate resources into any namespaceCVE-2026-54523 · Kyverno admission controller (NamespacedMutatingPolicy CEL generator library)Critical
• bank-vaults vault-secrets-webhook (vault-addr / vault-serviceaccount pod annotations): parseVaultConfig() honours aCVE-2026-54725 · bank-vaults vault-secrets-webhook (vault-addr / vault-serviceaccount pod annotations)Critical
• Dockhand: unauthenticated WebSocket exec gives shell access inside any container whose ID is knownCVE-2026-57169 · Dockhand (container exec WebSocket endpoint /api/containers/<id>/exec)Critical
• sigstore-js: substring registry match sends Docker config credentials to the wrong registryCVE-2026-59891 · sigstore-js @sigstore/oci (getRegistryCredentials registry matching)Critical
• RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they controlCVE-2026-70398 · Red Hat Advanced Cluster Management - multicloud-integrations (GitOpsCluster controller)Critical