Argo CD CVE-2026-113709

Requires that the operator has enabled --enable-helm for kustomize build - the single hard gate; without it the deployment is not affected. Argo CD must use a Kustomize version that forwards helmGlobals.configHome to Helm (Kustomize 4.1.0+, bundled since Argo CD 2.1), the helmCharts repository URL must use the downloader plugin's protocol to trigger execution, and the attacker must supply both the Kustomization and the plugin. Delivery path A: commit the files to a Git repository an Application builds (needs repository write or control of a built repo). Delivery path B (lower bar): POST to /api/v1/applications/manifestsWithFiles (or argocd app diff --local --server-side-generate), which needs only Application 'get' permission on an existing Application and NOT Application update, sync, or repository write. Limiting factors: the non-default --enable-helm requirement, at least low-privilege authenticated access (PR:L), and the plugin-protocol/configHome setup needed to trigger Helm.

The input CVSS is 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network-reachable, low-complexity exploitation by a low-privileged authenticated user with a scope change (code runs in argocd-repo-server and exposes credentials for other repositories). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation at time of analysis - the raw 9.9 overstates immediate real-world urgency. The decisive mitigating signal is a precondition the CVSS base score does not capture: exploitation is ONLY possible when an operator has enabled --enable-helm for kustomize build; deployments without it are entirely unaffected, which sharply narrows the actually-exposed population. PR:L is justified because the manifestsWithFiles upload path needs only Application 'get' permission on an existing Application - not update, sync, or repository write - so a low-privilege tenant in a multi-tenant Argo CD instance is a realistic threat actor. Data conflicts to verify: the pasted 'Source code evidence' (GHSA-j6cw-g6p4-7hch) describes a SEPARATE vulnerability (SSH SOCKS5 proxy command injection) and its version ranges (>= 2.11.0), which contradict this CVE's description range (from 2.1.0, matching GHSA-fw5c-w8rc-j7fx); treat the affected-version range as not independently confirmed. Net: a genuine high priority for multi-tenant Argo CD installations that have turned on --enable-helm, but lower practical risk where that flag is off.

A low-privileged tenant who holds only Application 'get' permission POSTs a crafted Kustomization plus a malicious Helm downloader plugin to /api/v1/applications/manifestsWithFiles (also reachable via argocd app diff --local --server-side-generate). When argocd-repo-server builds the manifests with --enable-helm, helmGlobals.configHome points Helm at the attacker-supplied directory, Helm auto-loads the downloader plugin and runs its program as the repo-server user, allowing it to read stored repository credentials and other process-accessible data. No public exploit was identified at time of analysis; the network vector and low complexity (AV:N/AC:L) make exploitation straightforward once --enable-helm is set.