CVE-2026-113672: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in argoproj argo-cd

Argo CD versions 0.9.0 through before 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contain a path traversal vulnerability (CWE-22) in the repo-server component's evaluation of .jsonnet files. The importer used does not restrict import, importstr, or importbin operations to the repository root, allowing absolute paths, parent-directory traversal, and symlinks to access any file readable by the repo-server. This can expose sensitive information such as /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although Secrets are redacted, imported contents placed in ConfigMaps are returned to the caller. Additionally, using importstr on devices like /dev/zero can exhaust memory. Exploitation requires only Application get permission on an existing directory Application, without needing update, sync, or repository write permissions. The vulnerability is addressed in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Successful exploitation can lead to unauthorized disclosure of sensitive files accessible by the repo-server, including environment variables, service-account tokens, private keys, and repository credentials. This can compromise the confidentiality and integrity of the Kubernetes environment managed by Argo CD. Additionally, resource exhaustion is possible by importing from non-terminating devices, potentially causing denial of service.

This vulnerability is fixed in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Users should upgrade to one of these versions or later to remediate the issue. Until patched, restrict Application get permissions to trusted users and avoid using untrusted .jsonnet files in applications. No other vendor advisory mitigation instructions are provided.