BIT-argo-cd-2026-113709

    Dashboard / Vulnerabilities / BIT-argo-cd-2026-113709

    BIT-argo-cd-2026-113709

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary: Argo CD: A Kustomize Helm config home can run commands in the repo-server

    Details: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0.

    References: https://argo-cd.readthedocs.io/en/stable/user-guide/kustomize/#kustomizing-helm-charts, https://github.com/argoproj/argo-cd/commit/b6d5c23bce2f8a46c52975ba438a3b93d242d96c, https://github.com/argoproj/argo-cd/pull/6059, https://github.com/argoproj/argo-cd/releases/tag/v3.3.15, https://github.com/argoproj/argo-cd/releases/tag/v3.4.10, https://github.com/argoproj/argo-cd/releases/tag/v3.5.4, https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2, https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx, https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch, https://github.com/kubernetes-sigs/kustomize/pull/3784, https://nvd.nist.gov/vuln/detail/CVE-2026-113709

    Affected packages

    Package

    Name: argo-cd

    Purl: pkg:bitnami/argo-cd

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.1.0
    Fixed -3.3.15

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-argo-cd-2026-113709 | CVE-DB