Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-113672: Argo CD can read any file via Jsonnet import
CVE-2026-113672 · published 7 days ago
Summary
Argo CD versions up to 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2 allow Jsonnet files to import any file the server can access, including sensitive credentials. An attacker could place a malicious Jsonnet file in a Git repo or upload it through the API to expose data or exhaust memory. Upgrade to the fixed versions or restrict Jsonnet usage to trusted sources.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| argoproj | argo-cd | >= 0.9.0, < 3.3.1 |
Original advisory text
Argo CD: A Jsonnet import can read files from the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
References
- https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-buil... URL
- https://github.com/argoproj/argo-cd/commit/27471d524958878e7acc5131fb466b292079c... Patch
- https://github.com/argoproj/argo-cd/pull/561 Patch
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.15 URL
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.10 URL
- https://github.com/argoproj/argo-cd/releases/tag/v3.5.4 URL
- https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-1136... Vendor Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3 Vendor Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h Vendor Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-113672 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-22Path Traversal
Timeline
Published20 Oct 2026
Updated27 Oct 2026
First seen20 Oct 2026
Track software like this
Free during beta