Command Injection Vulnerability in Argo CD Tool for Kubernetes
CVE-2026-113708
What is CVE-2026-113708?
Argo CD is a GitOps continuous delivery tool for Kubernetes that is affected by a command injection vulnerability allowing attackers to execute commands on the argocd-repo-server. This occurs when Kustomize improperly handles ref or version query values from remote resource URLs. An attacker can exploit this by providing a leading-hyphen value in a Git repository, which can bypass security measures and run commands as the repo-server user. The affected versions are vulnerable to attacks even if the repo-server's egress is blocked, as the command execution remains internal. Fixes have been implemented in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Affected Version(s)
argo-cd >= 2.7.0, < 3.3.15 < 2.7.0, 3.3.15
argo-cd >= 3.4.0-rc1, < 3.4.10 < 3.4.0-rc1, 3.4.10
argo-cd >= 3.5.0-rc1, < 3.5.4 < 3.5.0-rc1, 3.5.4