Kubernetes Continuous Delivery Tool Vulnerability in Argo CD
CVE-2026-113709
What is CVE-2026-113709?
A vulnerability exists in Argo CD which can potentially allow an attacker to read sensitive repository credentials and process-accessible data. When the '--enable-helm' feature is activated during a kustomize build, the 'helmGlobals.configHome' variable may redirect to a repository-controlled location. Helm will automatically load a downloader plugin from this path without requiring a distinct plugin-installation step and execute it within the argocd-repo-server context. This enables an unauthorized user with only Application get permission to exploit the vulnerability by committing a Kustomization file that also includes the harmful plugin to a Git repository or uploading it directly via the API. This weakness underscores the importance of ensuring that the '--enable-helm' setting is carefully controlled to prevent potential attack vectors.
Affected Version(s)
argo-cd >= 2.1.0, < 3.3.15 < 2.1.0, 3.3.15
argo-cd >= 3.4.0-rc1, < 3.4.10 < 3.4.0-rc1, 3.4.10
argo-cd >= 3.5.0-rc1, < 3.5.4 < 3.5.0-rc1, 3.5.4