Read the docs
TI-2023-20916 Aliases CVE-2023-40026GHSA-6jqw-jwf5-rp8h

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any version using Helm before 2.3), using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was possible because Helm paths were predictable. The vulnerability worked by adding a Helm chart that referenced Helm resources from predictable paths. Because the paths of Helm charts were predictable and available on an instance of repo-server, it was possible to reference and then render the values and resources from other existing Helm charts regardless of permissions. While generally, secrets are not stored in these files, it was nevertheless possible to reference any values from these charts. This issue was fixed in Argo CD 2.3 and subsequent versions by randomizing Helm paths. User's still using Argo CD 2.3 or below are advised to update to a supported version. If this is not possible, disabling Helm chart rendering, or using an additional repo-server for each Helm chart would prevent possible exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Fix Fixed argo-cd (argoproj): 2.3github.com/argoproj/argo-cd/v2 (Go): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-cdbefore 2.32.3Patch availableCNA
—github.com/argoproj/argo-cd (Go)up to 1.8.7—No fix listedGHSA-6jqw-jwf5-rp8h
—github.com/argoproj/argo-cd/v2 (Go)before 2.3.02.3.0Patch availableGHSA-6jqw-jwf5-rp8h
  • argo-cd Vendorargoproj Affected before 2.3 Fixed in 2.3 Patch available CNA
  • github.com/argoproj/argo-cd (Go) Vendor— Affected up to 1.8.7 Fixed in — No fix listed GHSA-6jqw-jwf5-rp8h
  • github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-6jqw-jwf5-rp8h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*before 2.3.0Vulnerableargoproj
  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions before 2.3.0 Vulnerable ·argoproj

Remediation

  • Fix · CNA argo-cd (argoproj) Fixed in 2.3
  • Fix · GHSA-6jqw-jwf5-rp8h github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift GitOps
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40026
  2. 2026-10-03 Alias added: GHSA-6jqw-jwf5-rp8h

References

Advisory 2

Other 3

  • TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
  • TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
  • TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
  • TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
  • TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
  • TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences