Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Argo CD, Helm, and Helm Operator may allow unauthorized actions

published 1 month ago
Summary

Several versions of Argo CD, Helm (including FIPS), and the Helm Operator contain a security weakness that could let attackers perform actions they shouldn’t be able to. The problem has been corrected in newer releases of each product. Update to the latest available versions to protect your systems.

What to do
  • Update cleanstart helm-fips to version 3.21.4-r0.
  • Update cleanstart argo-cd to version 3.2.12-r4.
  • Update cleanstart argo-cd to version 3.3.13-r0.
  • Update cleanstart argo-cd to version 3.3.14-r3.
  • Update cleanstart argo-cd to version 3.4.6-r1.
  • Update cleanstart argo-cd to version 3.4.7-r1.
  • Update cleanstart argo-cd-fips to version 3.4.7-r3.
  • Update cleanstart helm to version 4.0.5-r6.
  • Update cleanstart helm to version 4.1.4-r3.
  • Update cleanstart helm to version 4.2.3-r0.
  • Update cleanstart helm to version 4.2.4-r1.
  • Update cleanstart helm-fips to version 4.2.4-r0.
  • Update cleanstart helm-operator to version 1.39.2-r2.
  • Update cleanstart helm-operator to version 1.40.0-r2.
  • Update cleanstart helm-operator to version 1.42.2-r4.
  • Update cleanstart helm-operator to version 1.42.3-r3.
  • Update cleanstart kyverno to version 1.15.3-r3.
  • Update cleanstart kyverno to version 1.16.4-r3.
  • Update cleanstart kyverno to version 1.17.2-r2.
  • Update cleanstart kyverno to version 1.18.2-r0.
  • Update cleanstart rancher-agent to version 2.11.15-r2.
  • Update cleanstart rancher-agent to version 2.12.11-r3.
  • Update cleanstart rancher-agent to version 2.13.7-r2.
  • Update cleanstart rancher-agent to version 2.14.3-r0.
  • Update cleanstart rancher-fleet-agent to version 0.12.17-r2.
  • Update cleanstart rancher-fleet-agent to version 0.13.13-r1.
  • Update cleanstart rancher-fleet-agent to version 0.14.10-r1.
  • Update cleanstart rancher-fleet-agent to version 0.14.8-r3.
  • Update cleanstart rancher-fleet-agent to version 0.15.4-r3.
  • Update cleanstart rancher-fleet-agent to version 0.15.6-r0.
  • Update cleanstart rancher-fleet-agent to version 0.16.1-r1.
  • Update cleanstart tigera-operator to version 1.40.14-r1.
  • Update cleanstart tigera-operator to version 1.40.15-r1.
  • Update cleanstart tigera-operator to version 1.42.1-r3.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart helm-fips < 3.21.4-r0
< 4.2.4-r0
Fix: upgrade to 3.21.4-r0
CleanStart cleanstart argo-cd < 3.2.12-r4
< 3.3.13-r0
< 3.3.14-r3
< 3.4.6-r1
< 3.4.7-r1
Fix: upgrade to 3.2.12-r4
CleanStart cleanstart argo-cd-fips < 3.4.7-r3
Fix: upgrade to 3.4.7-r3
CleanStart cleanstart helm < 4.0.5-r6
< 4.1.4-r3
< 4.2.3-r0
< 4.2.4-r1
Fix: upgrade to 4.0.5-r6
CleanStart cleanstart helm-operator < 1.39.2-r2
< 1.40.0-r2
< 1.42.2-r4
< 1.42.3-r3
Fix: upgrade to 1.39.2-r2
CleanStart cleanstart kyverno < 1.15.3-r3
< 1.16.4-r3
< 1.17.2-r2
< 1.18.2-r0
Fix: upgrade to 1.15.3-r3
CleanStart cleanstart rancher-agent < 2.11.15-r2
< 2.12.11-r3
< 2.13.7-r2
< 2.14.3-r0
Fix: upgrade to 2.11.15-r2
CleanStart cleanstart rancher-fleet-agent < 0.12.17-r2
< 0.13.13-r1
< 0.14.10-r1
< 0.14.8-r3
< 0.15.4-r3
< 0.15.6-r0
< 0.16.1-r1
Fix: upgrade to 0.12.17-r2
CleanStart cleanstart tigera-operator < 1.40.14-r1
< 1.40.15-r1
< 1.42.1-r3
Fix: upgrade to 1.40.14-r1
Original advisory text
Security fix for CVE-2026-50163 applied in: argo-cd 3.2.12-r4, argo-cd 3.3.13-r0, argo-cd 3.3.14-r3, argo-cd 3.4.6-r1, argo-cd 3.4.7-r1, argo-cd-fips 3.4.7-r3, helm 4.0.5-r6, helm 4.1.4-r3, helm 4.2.3-r0, helm 4.2.4-r1, helm-fips 3.21.4-r0, helm-fips 4.2.4-r0, helm-operator 1.39.2-r2, helm-operator 1.40.0-r2, helm-operator 1.42.2-r4, helm-operator 1.42.3-r3, kyverno 1.15.3-r3, kyverno 1.16.4-r3, kyverno 1.17.2-r2, kyverno 1.18.2-r0, rancher-agent 2.11.15-r2, rancher-agent 2.12.11-r3, rancher-agent 2.13.7-r2, rancher-agent 2.14.3-r0, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, tigera-operator 1.40.14-r1, tigera-operator 1.40.15-r1, tigera-operator 1.42.1-r3
CVE-2026-50163 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-BF41428 · OSV
Track software like this
Free during beta