Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
A critical flaw in Argo CD allows attackers to read sensitive files and crash servers via JSONnet evaluation, affecting versions up to 3.6.0-rc2.
Key points
- CVE-2026-113672 is rated Critical with a CVSS score of 9.9.
- Attackers need only read permissions on a directory application to exploit the flaw.
- Patches are available for versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
An attacker with minimal permissions can now read sensitive Kubernetes secrets and crash Argo CD servers. The vulnerability exists in how the tool processes JSONnet files, allowing access to any file the server can read. This includes service-account tokens and private keys. The exploit requires no write access to repositories, making it easier to trigger.
How it unfolded
- Argo CD versions from 0.9.0 through 3.6.0-rc2 were found to evaluate JSONnet files without restricting imports to the repository root.
- Attackers could use absolute paths or symlinks to access files outside the intended scope, such as environment variables or mounted credentials.
- The flaw also allows memory exhaustion by importing from non-terminating devices like /dev/zero, causing server crashes.
Who is affected
Organizations using Argo CD for GitOps continuous delivery are at risk. The vulnerability impacts versions 0.9.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Attackers need only "Application get" permission on an existing directory application. They do not require update, sync, or repository write access. This low barrier to entry expands the pool of potential attackers significantly.
The fix
The vendor has released patches for the affected versions. Users should upgrade to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2. These updates confine import operations to the repository root, preventing access to external files. Until patched, organizations should restrict who can upload or commit JSONnet files to monitored repositories.
What made it possible
This incident highlights the dangers of insufficient input validation in file processing components. When applications evaluate code or configuration files, they must strictly limit where those files can reference external resources. Without these boundaries, an attacker can traverse directory structures to access sensitive data. Teams usually implement strict sandboxing for such evaluators. Check whether your tools restrict file imports to known safe directories. This control prevents lateral movement and data exfiltration during the initial access phase.
What to do and how to stay safe: Argo CD
- Verify your Argo CD version against the list of affected releases and apply the latest patch immediately.
- Audit user permissions to ensure only trusted accounts have "Application get" access to directory applications.
- Monitor server logs for unusual JSONnet evaluation activity or unexpected file access patterns.
- Review configurations to ensure no sensitive data is exposed via ConfigMaps that might return imported contents.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What permissions are required to exploit this vulnerability?
An attacker needs only "Application get" permission on an existing directory application, without update or sync rights.
What is the CVSS score for CVE-2026-113672?
The vulnerability has a CVSS score of 9.9, classified as Critical.
Which Argo CD versions are affected?
Versions from 0.9.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are affected.
