Path Traversal and File Inclusion Vulnerability in Argo CD by ArgoProj
CVE-2026-113672
What is CVE-2026-113672?
Argo CD, a popular GitOps continuous delivery tool for Kubernetes, contains a vulnerability affecting versions 0.9.0 through 3.3.15 and select releases from the 3.4.x and 3.5.x series. The vulnerability arises in the repo-server's processing of .jsonnet files, which allows for unrestricted file imports that can traverse the filesystem. Malicious actors may exploit this flaw to access sensitive files, including environment variables, service account tokens, and credentials, by injecting Git commits with crafted .jsonnet files. While certain outputs are redacted, critical information can be extracted via ConfigMaps. Furthermore, using the importstr feature on certain devices could lead to resource exhaustion within the repo-server. Resolved in the latest updates, users are strongly encouraged to upgrade to secure versions.
Affected Version(s)
argo-cd >= 0.9.0, < 3.3.1 < 0.9.0, 3.3.1
argo-cd >= 3.4.0-rc1, < 3.4.10 < 3.4.0-rc1, 3.4.10
argo-cd >= 3.5.0-rc1, < 3.5.4 < 3.5.0-rc1, 3.5.4