Block Argo CD RCE: Helm Plugin Flaw in 2.1 to 3.6 Requires Patching
A critical vulnerability in Argo CD allows remote code execution via Helm plugins with minimal permissions, affecting versions up to 3.6.0-rc2.
Key points
- CVE-2026-113709 allows remote code execution in Argo CD versions 2.1.0 through 3.6.0-rc2.
- The flaw requires the --enable-helm flag for kustomize builds to be active.
- Attackers need only Application get permission to exploit the vulnerability via manifest uploads.
Argo CD versions from 2.1.0 up to 3.6.0-rc2 contain a critical vulnerability that allows remote code execution. The flaw, identified as CVE-2026-113709, exists when operators enable the --enable-helm flag for kustomize builds. This configuration allows Helm’s config directories to point to locations controlled by the repository. Helm then automatically loads and executes downloader plugins from these directories.
The risk
The vulnerability arises because Helm automatically loads a downloader plugin from the config home directory without a separate installation step. When a repository URL uses the plugin’s protocol, the program executes inside the argocd-repo-server. The command runs as the repo-server user, granting access to repository credentials and other process-accessible data. This execution happens during the build process for applications using the affected Helm charts.
Who is exposed
Environments are only affected if the operator has explicitly enabled --enable-helm for kustomize builds. Deployments that do not enable this specific flag are not vulnerable to this issue. The flaw affects Argo CD versions 2.1.0 through 3.3.14, 3.4.0-rc1 through 3.4.9, 3.5.0-rc1 through 3.5.3, and 3.6.0-rc1. Versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 have been fixed.
Cost and compliance
The National Vulnerability Database rates the severity of CVE-2026-113709 as critical with a CVSS score of 9.9. The weakness is classified under CWE-829. No financial costs or specific compliance mandates are mentioned in the source material regarding this vulnerability. Organizations should assess their exposure based on their current Argo CD version and configuration settings.
Our take on the response
Teams should verify whether the --enable-helm flag is active in their Argo CD deployments. If active, upgrading to the patched versions is the primary mitigation strategy. Since the exploit requires only read permissions on applications, restricting access to application manifests may help reduce the attack surface until patches are applied.
What defenders should look for
Security teams should monitor for unusual plugin execution within the argocd-repo-server process. Check logs for unexpected Helm downloader activities or connections to external repositories. Look for new files appearing in Helm’s config directories that were not manually installed. Alert on any code execution attempts originating from repository-controlled locations. Isolate affected nodes immediately if suspicious behavior is detected to prevent lateral movement.
What to do and how to stay safe
- Audit your Argo CD configuration to see if --enable-helm is enabled for kustomize builds.
- Upgrade to Argo CD 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 if you are running an affected version.
- Restrict permissions for Application get operations to limit the ability to upload malicious manifests.
- Monitor argocd-repo-server logs for unexpected plugin
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
