BIT-argo-cd-2026-113708

    Dashboard / Vulnerabilities / BIT-argo-cd-2026-113708

    BIT-argo-cd-2026-113708

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary: Argo CD: A Kustomize remote ref can run commands in the repo-server

    Details: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0.

    References: https://argo-cd.readthedocs.io/en/stable/user-guide/kustomize/#custom-kustomize-versions, https://github.com/argoproj/argo-cd/commit/25badeb7a1e154805340bb7237e0ce671f3772dd, https://github.com/argoproj/argo-cd/pull/12299, https://github.com/argoproj/argo-cd/releases/tag/v3.3.15, https://github.com/argoproj/argo-cd/releases/tag/v3.4.10, https://github.com/argoproj/argo-cd/releases/tag/v3.5.4, https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2, https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc, https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch, https://nvd.nist.gov/vuln/detail/CVE-2026-113708

    Affected packages

    Package

    Name: argo-cd

    Purl: pkg:bitnami/argo-cd

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.7.0
    Fixed -3.3.15

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-argo-cd-2026-113708 | CVE-DB