CVE-2026-113709

9.9 CRITICALpublic exploit available

Published 2026-10-20 · Updated 2026-10-21

AI risk analysis

Summary: Argo CD allows attackers to execute arbitrary code on the repo-server through malicious Helm plugins when Kustomize build uses helmGlobals.configHome with --enable-helm enabled. This vulnerability enables remote code execution with high privileges as the repo-server process.
Exploitability: Exploitation requires an operator to enable --enable-helm and a repository-controlled attacker to commit malicious Kustomization and plugin files, but once enabled it's relatively easy to exploit with minimal permissions needed to upload files via API endpoint.
Blast radius: The impact could be severe across all Kubernetes applications managed by Argo CD, as attackers could read repository credentials, execute arbitrary code, and potentially compromise the entire cluster through the compromised repo-server.
Detection: Monitor for unusual file uploads to the /api/v1/applications/manifestsWithFiles endpoint and check for execution of unknown binaries in the repo-server process context, particularly in directories under .data/plugins.
Prioritized remediation: Upgrade to Argo CD versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 immediately to fix this vulnerability.

rcekubernetesgitopsconfig-injection

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-829

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.