CVE-2026-113708
Argo CD: the repo-server renders untrusted repository content with its own privileges. A .jsonnet file can import any path the repo-server can read, including the files holding cluster credentials (CVE-2026-113672); Kustomize takes `ref`/`version` query values straight off a repository URL into a command line (CVE-2026-113708); and with --enable-helm for kustomize builds a chart can reach the same place (CVE-2026-113709). Any of the three ends as code execution in the repo-server, which holds every cluster the instance deploys to
- Severity
- critical
- Affected product
- Argo CD
- Affected versions
- Argo CD ≥ 2.7.0, < 3.3.15
- Affected versions
- Argo CD ≥ 3.4.0, < 3.4.10
- Affected versions
- Argo CD ≥ 3.5.0, < 3.5.4
- Fixed in
- Argo CD 3.3.15
- Fixed in
- Argo CD 3.4.10
- Fixed in
- Argo CD 3.5.4
- Detection basis
- Component version range
- Shipped rule
- Argo CD: Argo CD: the repo-server renders untrusted repository content with its own privileges. A .jsonnet file can import any path the repo-server can read, including the files holding cluster credentials (CVE-2026-113672); Kustomize takes `ref`/`version` query values straight off a repository URL into a command line (CVE-2026-113708); and with --enable-helm for kustomize builds a chart can reach the same place (CVE-2026-113709). Any of the three ends as code execution in the repo-server, which holds every cluster the instance deploys to
- Added to NewScan
- 2026-10-21
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Argo CD from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints Argo CD from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints Argo CD from its response and reports this CVE when the detected version falls inside the affected range below.
Related CVEs covered by this detection
The same shipped rule and upgrade also cover these identifiers:
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.