Bug 2550667 (CVE-2026-113709)

Summary:	CVE-2026-113709 github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: argocd: A Kustomize Helm config home can run commands in the repo-server
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anjoseph, gbenhaim, jprabhak, niyer, twaugh, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Argo CD, where a Kustomize kustomization can point Helm at a repository-controlled directory and load a plugin that runs when Kustomize Helm rendering is enabled in the repo-server. This allows an attacker to execute arbitrary commands inside argocd-repo-server and read repository credentials and other data accessible to that process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 16:16:57 UTC

Impact
When Kustomize Helm chart rendering is enabled, a kustomization can point Helm at a directory the repository controls and run a program from that directory inside argocd-repo-server. Kustomize copies helmGlobals.configHome into Helm’s config and data directories. Helm then loads a downloader plugin from <configHome>/.data/plugins with no separate plugin-install step, and runs it when a helmCharts repository URL uses that plugin’s protocol. The command runs as the repo-server user and can read repository credentials and anything else available to that process.

All versions from v2.1.0 onward are affected, including every currently supported release. v2.0.5 and earlier are not. The behavior was introduced in b6d5c23bc (2021-04-20, #6059), the change that upgraded the bundled Kustomize from 3.9.4 to 4.1.2, and was first released in v2.1.0. Kustomize 4.1.0 is what first passes helmGlobals.configHome through to Helm (kubernetes-sigs/kustomize#3784). Deployments that do not pass --enable-helm to kustomize build are not affected.

Two ways to supply the kustomization, both of which require that an operator has already enabled --enable-helm:

Commit it to a Git repository that an Application builds with Kustomize.
Upload it through POST /api/v1/applications/manifestsWithFiles (argocd app diff --local --server-side-generate). This needs only Application get on an existing Application. It does not need permission to update or sync the Application, or write access to its Git repository.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:

v3.6.0-rc2
v3.5.4
v3.4.10
v3.3.15
Kustomize Helm chart rendering still works for ordinary http, https, and oci chart repositories. The patch points Helm at an empty config and data directory for every Kustomize build, so helmGlobals.configHome cannot register a plugin.

Workarounds
Do not pass --enable-helm in kustomize.buildOptions. That is a complete workaround for this issue. Applications that render Helm charts through Kustomize cannot use it.

Restricting Application get, or blocking POST /api/v1/applications/manifestsWithFiles, closes only the upload path. A kustomization committed to Git is still built on the next sync while --enable-helm is set.

Credits
The Argo CD team would like to thank @hoang-prod for responsibly disclosing this issue according to our security reporting guidelines (https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).

References
Introducing commit: b6d5c23bce2f8a46c52975ba438a3b93d242d96c (#6059), first released in v2.1.0
Kustomize feature: kubernetes-sigs/kustomize#3784
Kustomizing Helm charts: https://argo-cd.readthedocs.io/en/stable/user-guide/kustomize/#kustomizing-helm-charts