StackRadar

GO-2026-5099

Critical

Advisory

Published 7 May 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.6
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
17
deployed by those charts
Fix available
1 of 3
affected packages

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 17 images.

Affected packageAffected versionsFixed inImages
github.com/argoproj/argo-cd/v3golangv3.3.73.2.11, 3.3.91
github.com/argoproj/argo-cd/v2golangv2.4.7, v2.4.11, v2.7.2, v2.7.8+7 moreno fix listed15
github.com/argoproj/argo-cdgolangv1.5.8no fix listed1
OSV records
GHSA-3v3m-wc6v-x4x3GO-2026-5099
Also known as
BIT-argo-cd-2026-42880, CVE-2026-42880, CVE-2026-43824

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
no fix listed

Open the chart page →

3,793
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
no fix listed

Open the chart page →

10,315
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

1,483
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

7,300
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercddevtron0.10.21 of 2See more

devtron-in-clustercd devtron 0.10.2

1 of the 2 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercddevtron-labs0.10.21 of 2See more

devtron-in-clustercd devtron-labs 0.10.2

1 of the 2 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-operatordevtron-labs0.23.31 of 11See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
no fix listed

Open the chart page →

13,450
apid-helpergkarthiks0.1.41 of 1See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
no fix listed

Open the chart page →

2,607
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed

Open the chart page →

1,334
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.2.11

Open the chart page →

535
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

25,934
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercdromholdings0.10.21 of 2See more

devtron-in-clustercd romholdings 0.10.2

1 of the 2 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

2,620
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
no fix listed

Open the chart page →

2,314
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed

Open the chart page →

6,671
argocd-operatorstatcan0.5.01 of 1See more

argocd-operator statcan 0.5.0

1 of the 1 container images this version deploys carry GO-2026-5099.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
no fix listed

Open the chart page →

1,985

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed
3
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
2
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed
1
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
1
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
no fix listed
1
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.9
3.2.11
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
no fix listed
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
no fix listed
1
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
no fix listed
1
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
no fix listed
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.