CVE-2026-113709: Argo CD Helm Plugin RCE Vulnerability

CVE-2026-113709 Overview

CVE-2026-113709 is a remote code execution vulnerability in Argo CD, the declarative GitOps continuous delivery tool for Kubernetes. The flaw affects Argo CD versions from 2.1.0 through 3.3.14, 3.4.9, 3.5.3, and 3.6.0-rc1 when operators enable --enable-helm for kustomize build. A repository-controlled helmGlobals.configHome value can redirect Helm's configuration and data directories to attacker-staged paths, causing argocd-repo-server to load and execute a malicious downloader plugin. The vulnerability is tracked under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact

An attacker with Application get permission can trigger code execution as the repo-server user, exposing repository credentials and other process-accessible secrets.

Affected Products

• Argo CD versions 2.1.0 through 3.3.14
• Argo CD 3.4.0 through 3.4.9 and 3.5.0 through 3.5.3
• Argo CD 3.6.0-rc1 (deployments with --enable-helm enabled for kustomize build)

Discovery Timeline

• 2026-10-20 - CVE-2026-113709 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113709

Vulnerability Analysis

The vulnerability stems from how Argo CD propagates the helmGlobals.configHome field from a Kustomization file into Helm when Kustomize invokes Helm chart inflation. Kustomize 4.1.0 first began passing helmGlobals.configHome through to Helm. When this path points at a repository-controlled directory, Helm reads its plugin registry from <configHome>/.data/plugins on startup.

Helm's downloader plugin model does not require a separate install step. When a helmCharts repository URL uses the plugin's protocol, Helm executes the referenced plugin binary inside the argocd-repo-server container. The plugin runs with the repo-server service account's privileges and can read repository credentials, Git tokens, and other data accessible to that process.

Root Cause

The root cause is unsafe propagation of a repository-controlled configuration value into a component (Helm) that treats its configuration directory as trusted. Kustomize PR #3784 introduced the pass-through of helmGlobals.configHome without validating that the resulting directory is outside the untrusted repository tree.

Attack Vector

Two delivery paths exist. An attacker can commit a malicious Kustomization and plugin binary to a Git repository that an Argo CD Application builds. Alternatively, the attacker can upload the files through POST /api/v1/applications/manifestsWithFiles, which is also exposed via argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application. It does not require update, sync, or repository write access, which significantly broadens the exploitable population.

# Patch excerpt from Argo CD commit b6d5c23: upgrade installer to kustomize 4.1.2
. $(dirname $0)/../tool-versions.sh

-KUSTOMIZE_VERSION=${KUSTOMIZE_VERSION:-$kustomize3_version}
+KUSTOMIZE_VERSION=${KUSTOMIZE_VERSION:-$kustomize4_version}

# Note that kustomize release URIs have changed for v3.2.1. Then again for
# v3.3.0. When upgrading to versions >= v3.3.0 please change the URI format.

Source: Argo CD Commit b6d5c23

Detection Methods for CVE-2026-113709

Indicators of Compromise

• Kustomization files containing helmGlobals.configHome pointing to in-repo relative paths or writable directories under the repo working tree.
• Presence of .data/plugins/ directories or plugin.yaml files inside Git repositories referenced by Argo CD Applications.
• Unexpected child processes spawned by argocd-repo-server outside the normal helm, kustomize, and git binaries.

Detection Strategies

• Scan all Git repositories referenced by Argo CD Applications for helmGlobals.configHome fields and Helm plugin manifests committed alongside charts.
• Audit the Argo CD API gateway for POST /api/v1/applications/manifestsWithFiles calls originating from accounts that only hold Application get permissions.
• Monitor argocd-repo-server pod syscall and process creation telemetry for binaries executed from repository-staged paths.

Monitoring Recommendations

• Enable verbose repo-server logging and ship events to a centralized log store for correlation with Application sync and diff activity.
• Alert on outbound network connections from argocd-repo-server to destinations that are not Git servers, Helm registries, or OCI registries.
• Track RBAC grants in Argo CD and flag any policy that broadly assigns applications, get to untrusted principals.

How to Mitigate CVE-2026-113709

Immediate Actions Required

• Upgrade Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 as soon as possible.
• If upgrading is not immediately possible, disable --enable-helm for kustomize build on the argocd-repo-server configuration.
• Rotate any credentials, Git tokens, and repository secrets accessible to the repo-server service account if exploitation is suspected.

Patch Information

The Argo CD maintainers released fixed versions v3.3.15, v3.4.10, v3.5.4, and v3.6.0-rc2. Technical background is documented in security advisories GHSA-fw5c-w8rc-j7fx and GHSA-j6cw-g6p4-7hch.

Workarounds

• Remove the --enable-helm flag from the kustomize build options in the Argo CD ConfigMap when Helm chart inflation via Kustomize is not required.
• Restrict Argo CD RBAC so that only trusted principals hold applications, get on sensitive Applications, limiting access to the manifestsWithFiles upload path.
• Enforce repository allow-lists and signed commit requirements for all Applications that build with Helm or Kustomize integrations.

# Example: disable Helm support in kustomize build via argocd-cm ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  kustomize.buildOptions: ""
  # Ensure --enable-helm is NOT present until upgrade is complete