Live › vulnerability › CVE-2026-113708
Go to dashboardA leading-hyphen ref or version value in a Kustomize remote URL is passed to git without an end-of-options separator, so git runs --upload-pack with an attacker-chosen command when the remote uses file://. The command runs as the argocd-repo-server user, which can read repository credentials and process data, and the output can return through manifest errors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the Argo CD version: argocd version or the argocd-repo-server image tag.
3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later; upgrading Kustomize alone does not fix itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
This page as .md · .json · in your agent: get_signal("CVE-2026-113708")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.