{"id":"CVE-2026-113708","kind":"vulnerability","aliases":["CVE-2026-113708"],"related":[],"title":"Argo CD: crafted Kustomize remote URL runs commands in repo-server","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","summary":"A leading-hyphen ref or version value in a Kustomize remote URL is passed to git without an end-of-options separator, so git runs --upload-pack with an attacker-chosen command when the remote uses file://. The command runs as the argocd-repo-server user, which can read repository credentials and process data, and the output can return through manifest errors.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["argo-cd","gitops","infrastructure","kubernetes"],"not_affected_if":["already-patched-versions","versions-before-2.7.0"],"how_to_check":"Check the Argo CD version: argocd version or the argocd-repo-server image tag.","fix":"Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later; upgrading Kustomize alone does not fix it.\nRestrict who holds Application get permission and who can call manifestsWithFiles until patched.","status":"open","published_at":"2026-10-20T19:17:33+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:26+00:00","updated_at":"2026-10-23T22:39:26+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later; upgrading Kustomize alone does not fix it.\nRestrict who holds Application get permission and who can call manifestsWithFiles until patched.","reach":"network","title":"Argo CD: crafted Kustomize remote URL runs commands in repo-server","impact":"high","summary":"A leading-hyphen ref or version value in a Kustomize remote URL is passed to git without an end-of-options separator, so git runs --upload-pack with an attacker-chosen command when the remote uses file://. The command runs as the argocd-repo-server user, which can read repository credentials and process data, and the output can return through manifest errors.","category":"infrastructure","who_cares":["argo-cd","kubernetes","gitops"],"confidence":0.8,"needs_auth":"yes","worst_case":"Commands run in repo-server, exposing repository credentials and secrets.","analyst_note":"Confirm the exact affected version ranges and whether any default Argo CD install exposes manifestsWithFiles; check the Argo CD advisory linked from NVD.","how_to_check":"Check the Argo CD version: argocd version or the argocd-repo-server image tag.\nunknown","needs_analyst":true,"not_affected_if":["versions-before-2.7.0","already-patched-versions"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000588,"input_tokens":3298,"output_tokens":517,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-113708':15A,18A '-2026':14A,17A '/api/v1/applications/manifestswithfiles':241C '2.7.0':103C '3.3.15':105C,307C '3.4.10':106C,308C '3.5.4':107C,309C '3.6.0':109C,311C '4.5.7':281C '5.0.0':276C 'accept':278C 'access':211C,274C 'affect':287C 'alon':293C 'also':242C 'app':246C 'applic':234C,258C,264C,266C 'argo':1A,20B,91C 'argo-cd':19B 'argocd':71B,153C,245C 'argocd-repo-serv':70B,152C 'attack':58B,223C 'attacker-chosen':57B 'base':121C 'block':184C 'build':235C 'cd':2A,21B,92C 'chosen':59B 'command':8A,60B,66B,150C,171C,195C 'commit':225C 'compon':123C 'continu':97C 'correct':296C 'craft':3A 'credenti':79B,206C 'cve':13A,16A 'data':82B,212C 'declar':95C 'deliveri':98C 'diff':247C 'egress':188C 'end':45B,131C 'end-of-opt':44B,130C 'error':90B,221C 'execut':148C,193C 'exist':263C 'expos':243C 'fetch':127C 'file':238C 'fix':304C 'generat':220C,252C 'get':259C 'git':41B,50B,126C,165C,230C 'gitop':22B,96C 'hyphen':28B,138C 'infrastructur':23B 'insid':151C 'introduc':277C 'issu':302C 'kubernet':24B,101C 'kustom':4A,35B,111C,227C,275C,288C 'lead':27B,137C 'leading-hyphen':26B,136C 'leav':180C 'local':161C,176C,248C 'manifest':89B,219C 'manifest-gener':218C 'miss':298C 'newer':291C 'option':47B,133C,299C 'output':85B,216C 'pack':54B,146C 'pars':142C 'pass':39B,112C 'path':255C 'permiss':260C,270C 'pod':182C 'post':240C 'prevent':191C 'process':81B,210C 'process-access':209C 'queri':116C 'rc2':110C,312C 'read':77B,204C 'ref':29B,113C 'reject':282C 'remot':5A,36B,63B,119C,158C,174C 'replac':285C 'repo':11A,72B,154C,186C,200C 'repo-serv':10A,185C,199C 'repositori':78B,205C,231C,272C 'requir':256C 'resourc':120C 'return':87B,215C 'run':7A,51B,67B,168C,196C 'separ':48B,134C,300C 'server':12A,73B,155C,187C,201C,250C 'server-side-gener':249C 'side':251C 'suppli':170C 'sync':269C 'tool':99C 'transport':162C,177C,284C 'updat':267C 'upload':53B,145C,237C,254C 'upload-pack':52B,144C 'url':6A,37B,124C 'use':64B,159C 'user':74B,202C 'valu':32B,117C,139C 'version':31B,115C,292C,306C 'wherea':280C 'without':42B,128C,265C 'write':273C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113708","severity":null,"published_at":"2026-10-20T19:17:33+00:00","modified_at":"2026-10-20T19:59:00+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}