Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-43824 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA: redhat-SADPCVSS-B:9.6 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/security/cve/CVE-2026-43824 redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2464613 redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43824.json redhat-SADP
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 CISA-ADPAdvisoryExploitRemedyVendor
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 [email protected]AdvisoryExploitRemedyVendor

Weakness Enumeration

CWE-IDCWE NameSource
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer[email protected]
CWE-312Cleartext Storage of Sensitive Informationredhat-SADP

Affected Products

ProductVersions
Argo CD
>= 3.2.0, <= 3.3.8 (semver)

CPE

  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*

Remediation

  • Upgrade: 3.3.9moderate effort
  • Upgrade: 3.2.11moderate effort

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-43824
NVD Published Date:
May 2, 2026
NVD Last Modified:
Jul 15, 2026
Source:
[email protected]
CVE-2026-43824 Details - Not Deferred