Skip to content
Threat Feed
Subscribe
critical advisory PoC

Argo CD: Arbitrary code execution via Helm downloader plugin (CVE-2026-113709)

Argo CD versions 2.1.0 through 3.6.0-rc1 are vulnerable to arbitrary code execution if --enable-helm is used, allowing attackers to inject a malicious Helm plugin via repository-controlled configuration.

CVE search metadata

CVE search record: CVE-2026-113709. Severity: critical. CVSS: 9.9. KEV: no. Product: Argo CD (2.1.0 to <3.3.15, 3.4.0 to <3.4.10, 3.5.0 to <3.5.4, 3.6.0-rc1). Brief: Argo CD: Arbitrary code execution via Helm downloader plugin (CVE-2026-113709). Brief link: https://feed.craftedsignal.io/briefs/2026-10-argo-cd-rce/

Triage facts

Revision 2
Applicability
Argo CD (2.1.0 to <3.3.15, 3.4.0 to <3.4.10, 3.5.0 to <3.5.4, 3.6.0-rc1)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 2Oct 20, 20:45 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: has_poc, lastmod, poc_references, references, updates

    Sources: 1

Argo CD, a GitOps continuous delivery tool, contains a vulnerability (CVE-2026-113709) that enables remote code execution within the 'argocd-repo-server' component. This vulnerability is present in versions 2.1.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. The flaw occurs when the '--enable-helm' flag is enabled for Kustomize builds. An attacker can influence the 'helmGlobals.configHome' setting to point to a directory controlled by a Git repository or via the 'manifestsWithFiles' API endpoint.

Because Helm automatically loads downloader plugins from the '<configHome>/.data/plugins' directory without additional installation steps, an attacker can place a malicious executable in this path. When the 'argocd-repo-server' attempts to process a chart using a protocol handled by the plugin, it executes the payload under the context of the 'repo-server' user. This allows for the exfiltration of repository credentials and sensitive environment data. This exploit requires only 'Application get' permissions.

Attack Chain

  1. The operator enables '--enable-helm' within the Argo CD Kustomize build configuration.
  2. The attacker gains read access to an existing Application, or the ability to commit to a Git repository used by an Application.
  3. The attacker crafts a malicious Helm downloader plugin.
  4. The attacker defines a Kustomization file that sets 'helmGlobals.configHome' to a repository-controlled directory.
  5. The attacker commits the plugin and configuration to a Git repository, or uploads the files via the 'POST /api/v1/applications/manifestsWithFiles' endpoint.
  6. The 'argocd-repo-server' performs a build operation, causing Helm to identify and load the malicious plugin from the attacker-controlled directory.
  7. The Helm plugin executes as the 'repo-server' user during the manifest generation process.
  8. The attacker exfiltrates sensitive repository credentials or process-accessible data from the 'argocd-repo-server' environment.

Impact

Successful exploitation allows for complete compromise of the 'argocd-repo-server' execution context. Attackers can steal repository credentials, access secret management data, and potentially pivot into the broader Kubernetes cluster environment, depending on the service account permissions granted to the Argo CD controller.

Recommendation

  1. Upgrade to the patched versions of Argo CD: 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 immediately.
  2. Review deployments for the use of the '--enable-helm' flag; disable this flag if Helm plugin functionality is not required for Kustomize builds.
  3. Restrict 'Application get' permissions to minimize the exposure of the 'manifestsWithFiles' API endpoint.

Immediate actions

Patch Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2.

IT Operations 24h

Mitigations

Disable --enable-helm flag in Kustomize build configuration if not strictly required.

immediate IT Operations

CVE-2026-113709