CVE-2026-113708: argo-cd >= 2.7.0, < 3.3.15, >= 3.4.0-rc1, < 3.4.10, >= 3.5.0-rc1, < 3.5.4, >= 3.6.0-rc1, < 3.6.0-rc2

Affected technology

argo-cd · >= 2.7.0, < 3.3.15, >= 3.4.0-rc1, < 3.4.10, >= 3.5.0-rc1, < 3.5.4, >= 3.6.0-rc1, < 3.6.0-rc2
argoproj

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.