Argo CD EUVD-2026-105249

Requires an authenticated principal with at least Application get permission on an existing Application (no Application update/sync permission and no repository write access needed) using the POST /api/v1/applications/manifestsWithFiles upload path - also reachable via 'argocd app diff --local --server-side-generate' - OR write access to a Git repository an Application builds. The malicious Kustomization must reference a remote base, component, or resource over a local transport (file://), and the deployment must run Kustomize 5.0.0 or later, which accepts file:// (4.5.7 rejects it); Argo CD bundles Kustomize 5.x by default from 2.7 onward. Limiting factors: exploitation needs authentication and the file:// local-transport path, and https:// remotes do NOT trigger command execution. Note that blocking repo-server egress does NOT mitigate, because the local transport stays inside the pod, and merely swapping in a newer Kustomize does not fix the missing option separator.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) indicates network-reachable, low-complexity, authenticated exploitation with a scope change and full confidentiality/integrity/availability impact - consistent with command execution inside argocd-repo-server. The critical real-world amplifier is the low privilege bar: the manifestsWithFiles upload path requires only Application get permission on an existing Application, with no update, sync, or repository-write rights, so a broad set of low-trust Argo CD users qualifies. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk here is driven by severity and ease of abuse rather than observed in-the-wild activity. One mitigation that defenders often rely on - blocking repo-server egress - is explicitly ineffective because the file:// local transport never leaves the pod. Net: treat as an urgent patch priority for any Argo CD instance where untrusted or semi-trusted principals hold even read-level Application access.

An attacker holding only Application get permission uploads a crafted Kustomization (a remote base/component/resource URL carrying a leading-hyphen ref or version value over a file:// local transport) via POST /api/v1/applications/manifestsWithFiles, or commits one to a Git repo an Application builds. During manifest generation, git fetch parses the value as --upload-pack and runs the attacker's command as the repo-server user, which can read stored repository credentials and return output through manifest-generation errors. No public exploit was identified in the provided data.