CVE-2026-113708: Argo CD Kustomize RCE Vulnerability

CVE-2026-113708 Overview

CVE-2026-113708 is an argument injection vulnerability [CWE-88] in Argo CD, the GitOps continuous delivery tool for Kubernetes. Affected versions span 2.7.0 through 3.3.14, 3.4.9, 3.5.3, and 3.6.0-rc1. The flaw originates in how Kustomize passes ref or version query values from remote resource URLs to git fetch without an end-of-options separator. A leading-hyphen value parses as --upload-pack and executes an arbitrary command inside the argocd-repo-server pod when the remote uses a local transport such as file://.

Critical Impact

Attackers with only Application get permission can execute arbitrary commands as the repo-server user, exfiltrate repository credentials, and bypass network egress controls because the local transport never leaves the pod.

Affected Products

• Argo CD 2.7.0 through 3.3.14
• Argo CD 3.4.0 through 3.4.9 and 3.5.0 through 3.5.3
• Argo CD 3.6.0-rc1

Discovery Timeline

• 2026-10-20 - CVE-2026-113708 published to NVD
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-113708

Vulnerability Analysis

The vulnerability stems from argument injection into git fetch invocations issued by Kustomize when processing remote resources, bases, or components. Kustomize forwards user-controlled ref and version query parameters directly to the Git command line. Git treats arguments beginning with - as options unless preceded by --, the end-of-options separator. Without that separator, a value such as --upload-pack=<command> is interpreted as a flag that instructs Git to execute an attacker-supplied binary during the fetch operation.

Execution occurs inside the argocd-repo-server pod. The compromised process can read repository credentials, Service Account tokens, and any other data accessible to the repo-server user. Error output from manifest generation returns command output to the attacker, giving a reliable exfiltration channel.

Root Cause

Kustomize 5.0.0 introduced acceptance of the file:// transport, which Kustomize 4.5.7 previously rejected. Local transports keep the Git operation inside the pod, so blocking repo-server egress does not stop exploitation. Replacing Kustomize alone does not remediate the issue because the missing -- separator remains the underlying defect.

Attack Vector

Two exploitation paths exist. First, an attacker with write access to a Git repository tracked by an Application commits a Kustomization that references a crafted remote URL. Second, an attacker uploads crafted files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application. It does not require Application update, sync, or repository write permissions, which significantly lowers the barrier to exploitation.

See the Argo CD Security Advisory GHSA-9v9p-x54c-58gc and Argo CD Security Advisory GHSA-j6cw-g6p4-7hch for additional technical detail.

Detection Methods for CVE-2026-113708

Indicators of Compromise

• Kustomization files containing remote resource URLs with ref= or version= query values beginning with a hyphen, especially values resembling --upload-pack.
• References to file:// transports in Kustomize resources, bases, or components committed to tracked repositories.
• Unexpected child processes spawned by the argocd-repo-server container, such as shells, package managers, or network utilities.
• Manifest-generation error messages containing shell output, environment variables, or credential material.

Detection Strategies

• Inspect audit logs for POST /api/v1/applications/manifestsWithFiles requests originating from accounts that only hold Application get permission.
• Scan Git repositories tracked by Argo CD Applications for Kustomization files containing hyphen-prefixed ref or version query parameters.
• Monitor argocd-repo-server pod process trees for executions that are not git, kustomize, or helm.

Monitoring Recommendations

• Forward Kubernetes audit logs and Argo CD API access logs to a centralized analytics platform for retention and correlation.
• Enable runtime process monitoring on the argocd-repo-server pod to flag unexpected binaries and outbound local socket activity.
• Alert on manifest-generation errors that include unusual byte sequences, base64-encoded payloads, or references to /proc, /var/run/secrets, or token files.

How to Mitigate CVE-2026-113708

Immediate Actions Required

• Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 as released by the Argo project.
• Audit Application RBAC and remove unnecessary get grants on Applications from service accounts and user roles.
• Rotate repository credentials, SSH keys, and tokens accessible to the argocd-repo-server service account if exploitation is suspected.
• Review all Kustomization files in tracked repositories for suspicious ref, version, or file:// entries added since 2.7.0 deployment.

Patch Information

Fixed versions are available at Argo CD Release v3.3.15, Argo CD Release v3.4.10, Argo CD Release v3.5.4, and Argo CD Release v3.6.0-rc2. The code change is tracked in Argo CD Commit 25badeb and Argo CD Pull Request #12299.

Workarounds

• Disable the manifestsWithFiles upload path at the API gateway or ingress if upgrading is not immediately possible.
• Restrict Application get permissions to trusted principals only and remove broad read grants.
• Pin Kustomize to a build that rejects file:// transports where feasible, understanding this does not fully remediate the argument injection; see the Argo CD Kustomize User Guide.
• Apply NetworkPolicies to the argocd-repo-server pod to limit lateral movement after exploitation, acknowledging that local transports bypass egress controls.

# Example: upgrade Argo CD via Helm to a fixed release
helm repo update
helm upgrade argocd argo/argo-cd \
  --namespace argocd \
  --version <chart-version-matching-3.5.4-or-later>

# Verify the running image
kubectl -n argocd get deploy argocd-repo-server \
  -o jsonpath='{.spec.template.spec.containers[0].image}'