{"schema":"threatline.record/2","record":{"id":"CVE-2026-113709","aliases":["BIT-argo-cd-2026-55797","CVE-2026-55797","GHSA-fw5c-w8rc-j7fx","GHSA-j6cw-g6p4-7hch","GO-2026-6701"],"summary":"Argo CD: A Kustomize Helm config home can run commands in the repo-server","details":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","categories":["Libraries & packages"],"product":"argo-cd","vendor":"argoproj","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113709","source_modified_at":"2026-10-21T15:52:55.778Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"argo-cd","vendor":"argoproj","versions":[{"status":"affected","version":">= 2.1.0, < 3.3.15"},{"status":"affected","version":">= 3.4.0-rc1, < 3.4.10"},{"status":"affected","version":">= 3.5.0-rc1, < 3.5.4"},{"status":"affected","version":">= 3.6.0-rc1, < 3.6.0-rc2"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v2"},"range":">= 2.1.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v3"},"range":">= 3.0.0, < 3.3.15 || >= 3.4.0, < 3.4.10 || >= 3.5.0, < 3.5.4 || = 3.6.0-rc1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","purl":"pkg:golang/github.com/argoproj/argo-cd/v2"},"ranges":[{"events":[{"introduced":"2.11.0"},{"last_affected":"2.14.21"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.3.15"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"ranges":[{"events":[{"introduced":"3.4.0"},{"fixed":"3.4.10"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"ranges":[{"events":[{"introduced":"3.5.0"},{"fixed":"3.5.4"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"ranges":[{"events":[{"introduced":"3.6.0-rc1"},{"fixed":"3.6.0-rc2"}],"type":"SEMVER"}],"versions":["3.6.0-rc1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v3"},"version":"3.3.15"},{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v3"},"version":"3.4.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v3"},"version":"3.5.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","source_modified_at":"2026-10-20T17:40:47Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/argoproj/argo-cd/v3"},"version":"3.6.0-rc2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"version":"3.3.15"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"version":"3.4.10"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"version":"3.5.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","source_modified_at":"2026-10-21T03:11:56.486094067Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v3","purl":"pkg:golang/github.com/argoproj/argo-cd/v3"},"version":"3.6.0-rc2"}],"cvss":9.9,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00424,"percentile":0.35613,"score_date":"2026-10-23"},"published_at":"2026-10-20T18:08:36.565Z","modified_at":"2026-10-21T15:52:55.778Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113709","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T15:52:55.778Z"},{"source":"GitHub Advisory Database","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-10-20T17:40:47Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-j6cw-g6p4-7hch","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-10-21T03:11:56.486094067Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113709","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/pull/6059","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/kubernetes-sigs/kustomize/pull/3784","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/commit/b6d5c23bce2f8a46c52975ba438a3b93d242d96c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://argo-cd.readthedocs.io/en/stable/user-guide/kustomize/#kustomizing-helm-charts","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/releases/tag/v3.3.15","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/releases/tag/v3.4.10","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/releases/tag/v3.5.4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-21T14:39:50.323448Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T15:52:55.778Z","content_hash":"5c2975c43a0d4640149b133d1d1f814b51e42c2857ed1bb182faaa62a78dcdff"}}