Vulnpedia
← Search CVEs

CVE-2026-113672

CRITICAL 9.9

Published 2026-10-20 · Last modified 2026-10-20

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

ELEVATED IMPACT

Severe if exploited (CVSS 9.9), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.8%chance of exploitation in 30 days · 57th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.9CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Argoproj

Products Argo Cd

Weakness (CWE)

  • CWE-22: : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

  • odf4/odf-multicluster-rhel9-operator as a component of Red Hat Openshift Data Foundation 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odf-multicluster-rhel9-operator?repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00
  • openshift-gitops-1/argocd-agent-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-agent-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00
  • openshift-gitops-1/argocd-image-updater-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-image-updater-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00
  • openshift-gitops-1/argocd-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00
  • openshift-gitops-1/gitops-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00
  • openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9-operator?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator

    Red Hat · CVE-2026-113672 · Updated 2026-10-20T19:55:15+00:00

All CVSS metrics

  • CRITICAL 9.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS