CVE-2026-113708

Undergoing Analysis Undergoing Analysis - In Progress

Command Injection in Argo CD via Kustomize Git Fetch

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113708

EUVD

EUVD-2026-105249

Affected Vendors & Products

Vendor	Product	Version / Range
argoproj	argo-cd	>= 2.7.0, < 3.3.15
argoproj	argo-cd	>= 3.4.0-rc1, < 3.4.10
argoproj	argo-cd	>= 3.5.0-rc1, < 3.5.4
argoproj	argo-cd	>= 3.6.0-rc1, < 3.6.0-rc2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability in Argo CD allows command injection via Kustomize remote references. When a remote URL's ref or version query value starts with a hyphen (e.g., --upload-pack=<command>), Git interprets it as an option rather than a version, enabling arbitrary command execution within the repo-server container. The attack works for file:// URLs but not https:// remotes. Exploitation can occur by committing a malicious Kustomization to a Git repository or uploading via the API endpoint POST /api/v1/applications/manifestsWithFiles.

Detection Guidance

Check Argo CD version with kubectl get deployments -n argocd argo-cd-argocd-repo-server -o jsonpath='{.spec.template.spec.containers[0].image}' to see if it is vulnerable. Inspect Kustomize manifests for remote URLs with ref values starting with hyphens. Monitor repo-server logs for unexpected Git command execution or errors indicating Git option parsing issues.

Impact Analysis

An attacker can execute commands as the repo-server user, potentially reading repository credentials and other sensitive data. The command runs with repo-server privileges, allowing access to process-accessible data. Exploitation requires only Application get permission on an existing Application for the API upload path, without needing update or sync permissions or repository write access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as repository credentials, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized command execution may result in data breaches, non-compliance with data protection regulations, and potential legal consequences.

Mitigation Strategies

Upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later. Restrict Application creation and update permissions to trusted users. Avoid using file:// URLs in Kustomize. Block API access to POST /api/v1/applications/manifestsWithFiles if not required.

Hi! I’m here to help you understand CVE-2026-113708. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...