Key points
- The flaw affects Argo CD versions 2.1.0 through 3.6.0-rc1 when --enable-helm is active.
- Attackers can execute code with repo-server user privileges using minimal application permissions.
- Fixes are available in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Argo CD versions starting from 2.1.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contain a critical security flaw. According to the National Vulnerability Database record for CVE-2026-113709, this issue has a CVSS score of 9.9. The problem arises when system operators enable the --enable-helm flag for kustomize builds. This configuration allows Helm’s config directories to point to locations controlled by repositories.
In plain English
When this specific setting is active, Helm automatically loads and runs downloader plugins from repository-controlled folders. It does this without requiring a separate plugin installation step. An attacker can place a malicious plugin in a Git repository that an application builds. Alternatively, they can upload files via the API endpoint for manifest generation. The command then executes inside the argocd-repo-server process.
The background
The executed code runs with the permissions of the repo-server user. This allows the attacker to read repository credentials and other data accessible to that process. The upload method requires only "Application get" permission on an existing application. It does not require update, sync, or repository write access. Both attack paths depend on the prior enablement of --enable-helm by an operator.
What changes now
Vendors have released fixes for this vulnerability. The corrected versions are 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Deployments that do not enable the --enable-helm flag are not affected by this issue. Kustomize 4.1.0 was the version that first passed the helmGlobals.configHome variable through to Helm, introducing this behavior.
Who needs to act first
Teams should prioritize updating systems where the helm plugin feature is active. Check internal configurations to identify which clusters use this setting. Roll out updates to exposed environments first, ensuring backups are current before making changes. Test the update in a non-production environment to verify compatibility. If immediate patching is not possible, disable the vulnerable feature to reduce exposure while waiting for maintenance windows.
What to do and how to stay safe: Argo CD
- Audit your Argo CD installations to determine if the --enable-helm flag is enabled for kustomize builds.
- Upgrade affected clusters to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 as soon as maintenance allows.
- Review application permissions to ensure users only have the minimum access required for their tasks.
- Monitor repository server logs for unusual plugin loading or execution attempts during the transition period.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Argo CD versions are vulnerable to this remote code execution flaw?
Versions 2.1.0 through 3.3.14, 3.4.0-rc1 through 3.4.9, 3.5.0-rc1 through 3.5.3, and 3.6.0-rc1 are affected.
Is a patch available for CVE-2026-113709?
Yes, fixes are available in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Can an attacker exploit this without write access to the repository?
Yes, an attacker can upload malicious files via the API with only Application get permission on an existing application.
