Organisations urged to patch Argo CD to block attackers from stealing sensitive tokens and keys

Argo CD has released updates to address a critical vulnerability in its repo-server component. The flaw allows attackers to read sensitive files on the host system by exploiting unconfined JSONnet import capabilities.

What happened

The National Vulnerability Database records CVE-2026-113672 as a critical issue with a CVSS score of 9.9. The weakness stems from the repo-server evaluating .jsonnet files with an importer that fails to restrict operations to the repository root. According to the advisory, this lack of confinement affects versions from 0.9.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. The importer permits absolute paths, parent-directory traversal, and the use of repository symlinks to access any file readable by the repo-server process.

Attackers can exploit this by committing a malicious .jsonnet file to a Git repository associated with an Application. Alternatively, they can upload such a file via the POST /api/v1/applications/manifestsWithFiles endpoint. This upload path is also exposed by the argocd app diff --local --server-side-generate command. Directory applications automatically evaluate every .jsonnet file found within the application directory, increasing the attack surface.

Why it matters

Successful exploitation grants access to sensitive data including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported content into a ConfigMap returns the raw data to the caller. This bypasses standard secret protection mechanisms. Furthermore, using importstr on non-terminating devices like /dev/zero can exhaust the repo-server memory, leading to denial of service.

The attack requires only Application get permission on an existing directory Application. It does not require Application update or sync permissions, nor does it need repository write access. This low privilege requirement makes the vulnerability accessible to a wider range of potential attackers within an organisation.

What happens next

• Identify all Argo CD instances running affected versions within your environment.
• Verify if any applications use directory-based configurations or allow manifest uploads.
• Plan immediate upgrades to the patched versions: 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2.
• Review access logs for suspicious JSONnet file commits or uploads prior to patching.

Patch priority

Teams should prioritise updating exposed Argo CD instances that handle external or untrusted repositories first. Check whether directory applications are in use, as these evaluate all JSONnet files automatically. Roll out the fix to production environments after validating in staging. Back up current configurations before applying updates. If immediate patching is not possible, restrict Application get permissions and monitor for unusual manifest uploads. Ensure network segmentation limits repo-server access to trusted sources only.

What to do and how to stay safe: Argo CD

• Audit current Argo CD versions against the affected list provided in the advisory.
• Restrict Application get permissions to reduce the attack surface for unauthorised uploads.
• Monitor repo-server logs for attempts to access sensitive paths or device files.
• Prepare upgrade plans for all instances once the vendor provides the confirmed update.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Argo CD versions are affected by CVE-2026-113672?

Versions from 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are affected.

Is there a fix available for this vulnerability?

Yes, the issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

What permissions are required to exploit this flaw?

An attacker needs only Application get permission on an existing directory Application.