CVE-2026-113672 argoproj CVE debrief

Who should care

Kubernetes administrators and security teams using Argo CD should assess exposure and verify affected versions. They should also implement compensating controls and monitor for suspicious activity. Additionally, security teams should review and update incident response plans, and conduct regular security audits and vulnerability assessments.

Why it matters

CVE-2026-113672 allows unauthorized access to sensitive data via .jsonnet files in Argo CD. Kubernetes administrators and security teams should assess exposure, verify affected versions, and implement compensating controls.

• Potential unauthorized access to sensitive data
• Possible exhaustion of repo-server memory
• Required verification of affected versions and systems
• Need for compensating controls and monitoring

Technical summary

The Argo CD vulnerability allows unauthorized access to sensitive data via .jsonnet files. The repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller.

Defensive priority

High

Recommended defensive actions

• Review and update Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2
• Restrict access to .jsonnet files and sensitive data
• Monitor for suspicious activity and implement compensating controls
• Verify affected versions and systems
• Implement additional security measures to prevent unauthorized access
• Conduct regular security audits and vulnerability assessments
• Review and update incident response plans

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and systems requires verification. The vulnerability allows unauthorized access to sensitive data via .jsonnet files in Argo CD, with potential impacts including data exposure and repo-server memory exhaustion. Kubernetes administrators and security teams should assess exposure, verify affected versions, and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.