Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
Attackers with read-only access to applications can execute commands on Argo CD repo servers by injecting git options through Kustomize files.
Key points
- The flaw allows remote code execution on the argocd-repo-server container.
- Exploitation requires only application read permissions, not repository write access.
- Patches are available for specific versions of Argo CD up to 3.6.0-rc2.
An attacker with minimal permissions can execute arbitrary commands on Argo CD infrastructure. The adversary needs only read access to an existing application resource. They do not require the ability to update applications or write to the underlying Git repository. This low-barrier entry point enables command execution within the repo-server process. The attacker leverages Kustomize configurations to inject malicious arguments into Git operations.
How it unfolded
- Argo CD versions from 2.7.0 through early 3.6.0 releases processed Kustomize inputs without sanitizing option separators.
- Attackers crafted Kustomization files containing leading-hyphen values that Git interpreted as command-line flags.
- The injected arguments triggered the --upload-pack option, causing the repo-server to execute commands locally.
- Output from the executed commands was returned to the attacker through manifest-generation error messages.
Who is affected
Argo CD users running versions 2.7.0 through 3.3.14, 3.4.0-rc1 through 3.4.9, 3.5.0-rc1 through 3.5.3, and 3.6.0-rc1 through 3.6.0-rc1 are affected. The vulnerability exists in the Kustomize integration used by the argocd-repo-server component. Any user who can view application details or upload manifests via the API is at risk. The issue affects deployments using local file transports for remote resources.
The fix
Vendors have released patches for Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. These updates correct the missing end-of-options separator in Git fetch operations. Upgrading to one of these patched versions resolves the vulnerability. Simply replacing the Kustomize component with a newer version does not fix the issue. The fix is specific to the Argo CD application logic handling these inputs.
What made it possible
This incident illustrates the risks of argument injection in supply chain tools. Teams usually rely on configuration files to define dependencies. When these files pass user-controlled data directly to system commands, attackers can manipulate arguments. This weakness serves the initial access or lateral movement stage of an intrusion. It allows adversaries to execute code on infrastructure components that handle configuration processing. Check whether your tooling sanitizes inputs passed to external binaries like Git.
What to do and how to stay safe: Argo CD
- Verify your Argo CD version against the list of affected releases and apply the vendor patch immediately.
- Audit API permissions to ensure users have only the minimum necessary access to application resources.
- Monitor repo-server logs for unusual git fetch operations or unexpected manifest generation errors.
- Review Kustomize configurations for any remote resource references using local file transports.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What permissions does an attacker need to exploit this flaw?
An attacker needs only Application get permission on an existing Application, without update or sync rights.
Does blocking egress from the repo-server prevent this attack?
No, because the local transport does not leave the pod, so egress blocking does not prevent execution.
Which specific Argo CD versions contain the fix?
The fix is available in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
