Update Argo CD to stop low-privilege attackers from reading secrets and crashing servers via JSONnet
A critical flaw allows attackers to read sensitive files and exhaust memory via JSONnet imports in Argo CD versions prior to the latest security updates.
Key points
- CVE-2026-113672 is rated CVSS 9.9 Critical due to unrestricted file access and denial-of-service potential.
- Attackers can exploit the flaw with only Application get permission, without needing repository write access.
- Fixes are available in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Argo CD users must update their deployments immediately to address a critical path traversal vulnerability that exposes sensitive credentials and keys. The flaw, tracked as CVE-2026-113672, allows attackers to read arbitrary files on the repo-server system. This includes projected service-account tokens, mounted private keys, and repository credentials. The National Vulnerability Database rates the severity as 9.9 Critical.
The risk
The vulnerability exists because the repo-server evaluates .jsonnet files using an importer that fails to confine operations to the repository root. According to the NVD record, absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server process. Attackers can access sensitive data such as /proc/self/environ and private keys. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller.
Furthermore, using importstr on a non-terminating device like /dev/zero can exhaust repo-server memory. This creates a denial-of-service condition alongside the information disclosure risk. The flaw affects the core functionality of how Argo CD processes declarative GitOps configurations. It allows an attacker to bypass standard repository boundaries and access the underlying host filesystem.
Who is exposed
The issue affects Argo CD from version 0.9.0 until specific patched releases. According to the NVD, the fixed versions are 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Specifically, versions 0.9.0 through 3.3.14, 3.4.0-rc1 through 3.4.9, 3.5.0-rc1 through 3.5.3, and 3.6.0-rc1 through 3.6.0-rc1 are vulnerable. Directory applications evaluate every .jsonnet file in the application directory, increasing exposure.
An attacker can commit a .jsonnet file to a Git repository used by an Application. Alternatively, they can upload the file through POST /api/v1/applications/manifestsWithFiles. This upload path is also exposed by the argocd app diff --local --server-side-generate command. Crucially, the upload path requires only Application get permission on an existing directory Application. Attackers do not need Application update or sync permission or repository write access to exploit this vector.
Cost and compliance
The source material does not provide specific data regarding financial costs, regulatory fines, or compliance framework impacts associated with this vulnerability. Organizations should assess their own risk tolerance and compliance requirements regarding unauthorized access to Kubernetes secrets and service-account tokens. No further details on economic or legal consequences are available in the provided records.
Our take on the response
The low permission requirement for exploitation makes this a high-priority threat for any Argo CD deployment. Teams should verify their current versions against the patched list immediately. Since the attack vector requires minimal privileges, existing low-privilege accounts could be leveraged for initial access. Prioritize updating directory applications that process user-submitted manifests.
What defenders should look for
Teams should monitor repo-server logs for unusual file access patterns outside the expected repository directories. Look for requests involving absolute paths or parent-directory traversal sequences like "../". Alert on high memory usage spikes on repo-server pods, which may indicate an attempt to exhaust resources via non-terminating device imports. Check for new ConfigMaps created shortly after manifest uploads, as these may contain exfiltrated data. Isolate affected pods if suspicious activity is detected to prevent further data leakage.
What to do and how to stay safe: Argo CD
- Update Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 to apply the official fix.
- Audit existing Argo CD applications for any .jsonnet files that import external or absolute paths.
- Review repo-server logs for unauthorized file access attempts or unusual memory consumption spikes.
- Restrict Application get permissions to the minimum necessary users to reduce the attack surface.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What permissions are needed to exploit this vulnerability?
An attacker needs only Application get permission on an existing directory Application, without requiring update, sync, or repository write access.
Which Argo CD versions are affected by CVE-2026-113672?
Versions from 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are affected, including specific pre-release ranges.
Can this vulnerability lead to a denial of service?
Yes, using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory.
