Key points
- The flaw affects Argo CD versions 2.1.0 up to, but not including, the fixed releases.
- Attackers need only Application get permission to exploit the issue via manifest uploads.
- Patches are available for versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Argo CD versions starting from 2.1.0 and ending before the specific fixed releases are vulnerable to a critical remote code execution flaw. The National Vulnerability Database rates CVE-2026-113709 with a CVSS score of 9.9. This issue arises when operators enable the --enable-helm flag for kustomize builds. Affected versions include those up to 3.3.14, 3.4.9, 3.5.3, and 3.6.0-rc1.
In plain English
The vulnerability allows an attacker to run arbitrary code on the Argo CD repo-server. This happens because Helm automatically loads and executes plugins from a directory controlled by the Git repository. An attacker can place a malicious plugin in this directory. When the system processes a Helm chart using the plugin's protocol, it runs the attacker's code. The command executes with the privileges of the repo-server user.
The background
This issue exists because Kustomize 4.1.0 began passing helmGlobals.configHome directly to Helm. This configuration points Helm's data directories to a location controlled by the repository. Helm loads downloader plugins from this path without requiring a separate installation step. The flaw is present only if the operator has explicitly enabled --enable-helm for kustomize builds. Deployments that do not use this setting are not affected by this specific vulnerability.
What changes now
Fixes are available for Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Users running any version between 2.1.0 and these fixed releases should upgrade immediately. The patch stops Helm from loading plugins from repository-controlled directories. This prevents the execution of malicious code via the helmCharts repository URL or manifest upload endpoints.
Who needs to act first
Teams should prioritize updating systems that expose their Argo CD instances to the internet or untrusted networks. Check whether your deployments use the --enable-helm flag for kustomize builds. If enabled, these systems face the highest risk. Begin by applying updates to staging environments to verify compatibility. Back up current configurations before rolling out changes to production. Limit network access to Argo CD APIs during the update process to reduce exposure while patches are being deployed.
What to do and how to stay safe: Argo CD
- Identify all Argo CD instances running versions between 2.1.0 and the fixed releases listed in the advisory.
- Verify if the --enable-helm flag is enabled for kustomize builds in your current configurations.
- Restrict network access to the Argo CD API endpoints until updates are applied and verified.
- Monitor logs for unusual plugin execution or unexpected commands running as the repo-server user.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What permissions are needed to exploit this vulnerability?
An attacker needs only Application get permission on an existing Application. They do not need Application update, sync permission, or repository write access.
Which Argo CD versions are fixed?
The issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Can this be exploited through local commands?
Yes, the upload path is also exposed by the argocd app diff --local --server-side-generate command.
