An Argo CD user who can only view an Application can run commands inside argocd-repo-server and read the Git credentials that process uses. The bug is CVE-2026-113708, rated 9.9 on CVSS 3.1, and it reaches every supported Argo CD release. The fixed versions shipped on October 6 and the GitHub advisory followed on October 7, but the CVE record only went public on October 20, so teams that triage by CVE number may be seeing it for the first time this week.
A Leading Dash Turns a Git Ref Into a Command
Kustomize can pull a remote base, resource, or component, and it hands that URL to git fetch. According to the advisory, it appends the URL’s ref or version value without the -- separator that tells Git where its options end, so a value like --upload-pack=<command> gets parsed as a Git flag. With a local file:// remote, Git runs that command inside the repo server as the repo-server user and then returns the output to the caller in the manifest-generation error.
The behavior arrived with the upgrade from bundled Kustomize 4.5.7 to 5.0.1, which first shipped in Argo CD v2.7.0, because Kustomize 5 is the first release that accepts file:// and passes it to Git. Versions 2.6.15 and earlier are not affected, and swapping in a newer Kustomize binary won’t help, since current Kustomize still passes ref through without the separator.
Read-Only Access Is Enough to Fire It
There are two ways in. Anyone who can commit to a Git repository that an Application builds with Kustomize can plant a poisoned kustomization. The second needs far less, because the server-side manifest upload behind argocd app diff --local --server-side-generate accepts a kustomization from any user with Application get on an existing Application, with no sync, update, or Git write rights involved.
A file:// remote never leaves the pod, so blocking repo-server egress does nothing, and restricting get or blocking the upload API only closes the second route while a kustomization committed to Git still builds on the next sync.
Upgrade First, Pin Kustomize Only If You’re Stuck
The maintainers say there is no complete workaround besides upgrading. The fix puts a git wrapper in front of the real binary for Kustomize builds so the URL and ref can’t be read as options, and remote bases keep working. Here is the order our team at TechForward would work in.
- Move to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or anything newer on your line. The newest patches, 3.3.17, 3.4.12, and 3.5.6, were all tagged on October 20 and include the fix.
- There is no patched 2.x release, so anyone on 2.7.0 or later in that line has to move to 3.x.
- If you can’t upgrade today, pin every Kustomize Application to a Kustomize older than 5.0, such as 4.5.7, by registering that binary in
argocd-cmand setting the version on each Application. Leaving 5.x registered keeps the hole open, and apps that need Kustomize 5 features will break under the pin. - While you wait, review who has
geton Applications and look through recent kustomizations for remote refs whosereforversionstarts with a dash. If anything turns up, rotate the repository credentials that repo server could reach.
Two More 9.9s Rode in on the Same Release
The same October 6 releases fix two siblings that also score 9.9. CVE-2026-113709 lets a kustomization point Helm’s config home at a directory in the repository and run a downloader plugin from it, on any install that passes --enable-helm to Kustomize, going back to v2.1.0. CVE-2026-113672 lets a Jsonnet import read any file the repo server can, including its environment, its service account token, and repository credentials, going back to v0.9.0.
A view-only role was supposed to be the boring one. On unpatched Argo CD it can reach the repository credentials every sync depends on, which is why this release went to the top of our list. The LiteLLM supply chain attack showed how much SSH key and cloud credential damage one compromised piece of delivery tooling can do, and Argo CD has been on our GitOps standouts list since 2024 because so many Kubernetes teams deploy through it. Read the full advisory, then pull the newest build for your release line from the Argo CD releases page today.
