Skip to content
OpenAdvisories
High WID-SEC-2026-3802 5 CVEs

Argo CD: Mehrere Schwachstellen

Published Oct 7, 2026 · Updated Nov 2, 2026 · Revision 5 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Argo CD ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen und Zugangsdaten auszulesen, Zugriffsbeschränkungen zu umgehen oder einen Denial of Service zu verursachen.

Product

Open Source Argo CD ist ein deklaratives, GitOps-basiertes Continuous-Delivery-Tool für Kubernetes.

Vulnerabilities 5

  • Critical 9.9
    CVE-2026-113708

    Argo CD: A Kustomize remote ref can run commands in the repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options …

    argoproj Argo CD
  • Critical 9.9
    CVE-2026-113709

    Argo CD: A Kustomize Helm config home can run commands in the repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directorie…

    argoproj Argo CD
  • Critical 9.9
    CVE-2026-77459

    Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used duri…

    argoproj Argo CD argo-cd-3.2-compat argo-cd-3.2 Wolfi Go
  • High 8.8
    CVE-2026-55797 Public exploit

    Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured wit…

    argoproj Argo CD argo-cd-3.2-compat argo-cd-3.2 Wolfi Go
  • High 8.1
    CVE-2025-61560

    A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows a…

Revision history

  1. #5

    Neue Updates von Red Hat aufgenommen

  2. #4

    Referenz(en) aufgenommen: CVE-2026-113709, EUVD-2026-105250, CVE-2026-113708, EUVD-2026-105249

  3. #3

    Referenz(en) aufgenommen: EUVD-2026-98917

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-95912, EUVD-2025-211059

  5. #1

    Initiale Fassung

References