CVE-2026-113709: Argo CD: A Kustomize Helm config home can run commands in the repo-server

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.4%, percentile 36: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 36% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Editorial verdict: Patch this week. Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026) — Upgrade Argo CD to a patched 3.3, 3.4 or 3.5 release this week, and today on shared instances where people you do not fully trust can push to tracked repos or merely view an Application.

What it is

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from /.data/plugins without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Weakness type: CWE-829.

Product: argoproj argo-cd · Assigned by: GitHub_M · Published: 2026-10-20

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.42% probability of exploitation activity in the next 30 days; percentile 36.

Timeline

• 2026-10-07 — erroneo.us brief: Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)
• 2026-10-20 — CVE record published by GitHub_M
• 2026-10-21 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. CVE.org record CVE-2026-113709 cve.org
2. NVD entry CVE-2026-113709 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. argo-cd.readthedocs.io argo-cd.readthedocs.io
7. github.com github.com
8. github.com github.com
9. github.com github.com
10. github.com github.com

Today’s Security Digest