Which versions of Argo CD are affected by CVE-2026-62185?

Argo CD Helm chart versions before 10.0.0 contain a critical configuration gap that eliminates network boundaries between workloads in Kubernetes clusters, enabling attackers with any pod access to…

How to fix or mitigate CVE-2026-62185?

Within 24 hours: Audit all Argo CD deployments to identify instances running versions before 10.0.0 and assess co-location with third-party or untrusted workloads. Within 7 days: Deploy Kubernetes NetworkPolicy rules to restrict inbound access to Argo CD repo-server and internal APIs to only authorized namespaces; implement pod security policies and RBAC restrictions to contain lateral movement. Within 30 days: Plan and execute upgrade to Argo CD Helm chart version 10.0.0 or later; validate that default NetworkPolicy rules are enforced post-upgrade and network isolation is maintained.

Argo CD CVE-2026-62185

Q: What is the CVSS score of CVE-2026-62185?

CVE-2026-62185 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-07-13 VulnCheck

RCE Argo Helm Argoproj

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Attacker needs an in-cluster pod foothold (AV:A, PR:L) but no user interaction; exposed repo-server yields high confidentiality/integrity and limited availability impact, scope unchanged.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:09 vuln.today

CVE Published

Jul 13, 2026 - 21:31 cve.org

HIGH 8.6

DescriptionCVE.org

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

AnalysisAI

Insecure-default configuration in the Argo CD (argoproj/argo-helm) Helm chart before 10.0.0 ships without any Kubernetes NetworkPolicy, so every pod sharing the cluster can reach the repo-server and other internal Argo CD APIs that are normally meant to be isolated. A low-privileged workload that an attacker already controls can chain this unrestricted intra-cluster access into full cluster compromise and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates real-world impact high (CVSS 4.0 base 8.6).

Technical ContextAI

Argo CD is a GitOps continuous-delivery controller for Kubernetes; the affected component is the community argo-helm chart (CPE cpe:2.3:a:argoproj:argo-helm) used to deploy it. Argo CD's architecture splits into several microservices - repo-server (which clones Git/Helm repos and renders manifests, holding repo credentials), application-controller, and API/server components - that communicate over in-cluster gRPC/HTTP and are intended to be reachable only by other Argo CD components. The root cause is CWE-1188 (Initialization of a Resource with an Insecure Default Setting): the chart did not enable NetworkPolicy objects by default, so Kubernetes' default 'allow-all' pod-to-pod networking left these sensitive internal services exposed to any pod in the cluster rather than restricted to Argo CD's own namespace/service accounts.

RemediationAI

Vendor-released patch: upgrade the argo-helm Argo CD chart to version 10.0.0 or later, which installs the network policies by default, and confirm the NetworkPolicy resources are actually created in the Argo CD namespace after deployment. If an immediate chart upgrade is not possible, the primary compensating control is to enable NetworkPolicies explicitly (many chart versions expose a value such as global/networkPolicy.create=true) or to author your own Kubernetes NetworkPolicy that restricts ingress to repo-server, application-controller, and the Argo CD API/server so only Argo CD's own pods can reach them - note this requires a CNI plugin that enforces NetworkPolicy (e.g. Calico, Cilium), otherwise the policy is silently ignored. As a further mitigation, run Argo CD in a dedicated namespace, avoid co-locating untrusted/multi-tenant workloads on the same cluster, and enforce mesh or CNI-level segmentation; the trade-off is added operational complexity and the need to whitelist legitimate cross-namespace traffic. See GHSA-47m3-95c7-g2g8 and the VulnCheck advisory (https://www.vulncheck.com/advisories/argo-cd-helm-chart-missing-network-policy-rce) for specifics.