Argo CD (2.1.0 to <3.3.15, 3.4.0 to <3.4.10, 3.5.0 to <3.5.4, 3.6.0-Rc1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/argo-cd-2.1.0-to-3.3.15-3.4.0-to-3.4.10-3.5.0-to-3.5.4-3.6.0-rc1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 19:45:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArgo CD: Arbitrary code execution via Helm downloader plugin (CVE-2026-113709)https://feed.craftedsignal.io/briefs/2026-10-argo-cd-rce/Tue, 20 Oct 2026 19:45:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-argo-cd-rce/Argo CD versions 2.1.0 through 3.6.0-rc1 are vulnerable to arbitrary code execution if --enable-helm is used, allowing attackers to inject a malicious Helm plugin via repository-controlled configuration.Argo CD, a GitOps continuous delivery tool, contains a vulnerability (CVE-2026-113709) that enables remote code execution within the 'argocd-repo-server' component. This vulnerability is present in versions 2.1.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. The flaw occurs when the '--enable-helm' flag is enabled for Kustomize builds. An attacker can influence the 'helmGlobals.configHome' setting to point to a directory controlled by a Git repository or via the 'manifestsWithFiles' API endpoint.

Because Helm automatically loads downloader plugins from the '<configHome>/.data/plugins' directory without additional installation steps, an attacker can place a malicious executable in this path. When the 'argocd-repo-server' attempts to process a chart using a protocol handled by the plugin, it executes the payload under the context of the 'repo-server' user. This allows for the exfiltration of repository credentials and sensitive environment data. This exploit requires only 'Application get' permissions.

Attack Chain

  1. The operator enables '--enable-helm' within the Argo CD Kustomize build configuration.
  2. The attacker gains read access to an existing Application, or the ability to commit to a Git repository used by an Application.
  3. The attacker crafts a malicious Helm downloader plugin.
  4. The attacker defines a Kustomization file that sets 'helmGlobals.configHome' to a repository-controlled directory.
  5. The attacker commits the plugin and configuration to a Git repository, or uploads the files via the 'POST /api/v1/applications/manifestsWithFiles' endpoint.
  6. The 'argocd-repo-server' performs a build operation, causing Helm to identify and load the malicious plugin from the attacker-controlled directory.
  7. The Helm plugin executes as the 'repo-server' user during the manifest generation process.
  8. The attacker exfiltrates sensitive repository credentials or process-accessible data from the 'argocd-repo-server' environment.

Impact

Successful exploitation allows for complete compromise of the 'argocd-repo-server' execution context. Attackers can steal repository credentials, access secret management data, and potentially pivot into the broader Kubernetes cluster environment, depending on the service account permissions granted to the Argo CD controller.

Recommendation

  1. Upgrade to the patched versions of Argo CD: 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 immediately.
  2. Review deployments for the use of the '--enable-helm' flag; disable this flag if Helm plugin functionality is not required for Kustomize builds.
  3. Restrict 'Application get' permissions to minimize the exposure of the 'manifestsWithFiles' API endpoint.
]]>criticaladvisoryremote-code-executiongitopskubernetes