CVE-2026-113709
Awaiting Analysis Awaiting Analysis - Queue

Code Execution via Helm Plugin in Argo CD

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113709
EUVD
EUVD-2026-105250

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
argoproj argo-cd >= 2.1.0, < 3.3.15
argoproj argo-cd >= 3.4.0-rc1, < 3.4.10
argoproj argo-cd >= 3.5.0-rc1, < 3.5.4
argoproj argo-cd >= 3.6.0-rc1, < 3.6.0-rc2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113709 is a command injection vulnerability in Argo CD affecting versions 2.1.0 to 3.6.0-rc2. When --enable-helm is enabled for Kustomize builds, an attacker can manipulate helmGlobals.configHome to point to a repository-controlled location. Helm then loads and executes a downloader plugin from that location without installation, running arbitrary commands in the argocd-repo-server process as the repo-server user. This exposes repository credentials and other sensitive data.

Detection Guidance

Check if --enable-helm is enabled in Kustomize build options by inspecting Argo CD configurations or logs. Look for suspicious plugin files in <configHome>/.data/plugins directories. Monitor argocd-repo-server processes for unexpected command executions or unauthorized access patterns.

Impact Analysis

An attacker with access to a Git repository or API endpoint can execute arbitrary commands in the argocd-repo-server. This may lead to unauthorized access to sensitive data like Git, Helm, or OCI credentials stored for the repo-server. The attack requires prior operator enablement of --enable-helm but no additional permissions beyond Application get permission on an existing Application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Argo CD versions may face compliance violations due to potential data breaches.

Mitigation Strategies

Upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later. Disable --enable-helm in kustomize.buildOptions as a temporary workaround. Restrict Application get permissions to prevent unauthorized manifest generation via API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart