---
id: "CVE-2026-113709"
kind: "vulnerability"
aliases: ["CVE-2026-113709"]
title: "Argo CD: repo-server runs attacker plugin through Helm when enabled"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["argocd", "gitops", "infrastructure", "kubernetes", "runtime", "self-hosted"]
not_affected_if: ["default-config", "fixed-versions", "no-enable-helm", "versions-before-2.1.0"]
published_at: "2026-10-20T19:17:33+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T22:39:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113709", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Argo CD: repo-server runs attacker plugin through Helm when enabled

When Argo CD runs with --enable-helm, a Kustomization in a Git repo can make Helm load a downloader plugin that executes code inside argocd-repo-server. The attacker can then read repository credentials and other data the repo-server process can access, and the upload endpoint needs only Application get permission.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the argocd-repo-server or argocd-application-controller args include --enable-helm (kubectl get deploy argocd-repo-server -n argocd -o yaml | grep enable-helm).
Check the running Argo CD version (argocd version).

## Fix

Upgrade to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 (the fixed release on your minor line). If you do not need Helm inside kustomize build, remove --enable-helm.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113709

## From the sources

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_