CVE-2026-113672
Received Received - Intake

Path Traversal in Argo CD via Jsonnet Imports

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113672
EUVD
EUVD-2026-105227

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
argoproj argo-cd >= 0.9.0, < 3.3.1
argoproj argo-cd >= 3.4.0-rc1, < 3.4.10
argoproj argo-cd >= 3.5.0-rc1, < 3.5.4
argoproj argo-cd >= 3.6.0-rc1, < 3.6.0-rc2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Argo CD versions 0.9.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 have a vulnerability where the repo-server evaluates .jsonnet files without restricting import paths. This allows attackers to access files outside the repository root, including sensitive system files like /proc/self/environ or service-account tokens, by using absolute paths or directory traversal. Attackers can also exhaust server memory by importing non-terminating devices like /dev/zero.

Detection Guidance

Check for unauthorized .jsonnet files in Argo CD application directories or repositories. Inspect repo-server logs for suspicious importstr operations targeting files like /proc/self/environ or /dev/zero. Use Kubernetes audit logs to detect POST /api/v1/applications/manifestsWithFiles requests from unauthorized users.

Impact Analysis
  • Unauthorized access to sensitive files on the server running Argo CD.
  • Potential denial-of-service by exhausting server memory.
  • Exposure of credentials or configuration data through imported files.
  • Ability to manipulate application manifests via malicious .jsonnet files.
Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Exposure of credentials or tokens may also breach compliance with access control and audit logging standards.

Mitigation Strategies
  • Upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later.
  • Disable Jsonnet processing in the argocd-cm ConfigMap by removing or restricting the Jsonnet tool.
  • Review and remove any unauthorized .jsonnet files from application directories.
  • Audit user permissions to prevent unauthorized access to Application resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart