Update Argo CD Now: Low Privileges Enable Server-Side Code Execution via Helm Plugin Injection

An attacker can execute arbitrary code on Argo CD repository servers by injecting malicious Helm plugins. This capability allows unauthorized access to repository credentials and other sensitive data accessible to the server process. The flaw affects Argo CD versions from 2.1.0 up to specific patched releases in the 3.3, 3.4, 3.5, and 3.6 series.

The vulnerability is rated Critical with a CVSS score of 9.9 by the National Vulnerability Database. It stems from how Argo CD handles Helm configuration when the --enable-helm flag is active for Kustomize builds. The weakness allows attackers to redirect Helm’s configuration directories to locations they control within a Git repository.

How the attack works

When an operator enables the --enable-helm flag, Argo CD passes the helmGlobals.configHome setting to Helm. This setting determines where Helm looks for its configuration and data directories. An attacker can set this value to point to a directory inside a Git repository that Argo CD is processing.

Helm automatically loads downloader plugins from the specified configuration directory without requiring a separate installation step. If the repository contains a malicious plugin, Helm executes its program inside the argocd-repo-server process. This execution happens when the repository URL uses the plugin’s specific protocol.

Who is affected

The issue impacts Argo CD versions 2.1.0 through 3.3.14, 3.4.0-rc1 through 3.4.9, 3.5.0-rc1 through 3.5.3, and 3.6.0-rc1. Deployments that do not enable the --enable-helm flag for Kustomize builds are not affected by this specific vulnerability.

Exploitation requires prior enablement of the Helm feature by the system operator. Once enabled, an attacker needs only Application get permission on an existing Application resource. They do not need Application update, sync permissions, or direct repository write access to trigger the execution.

What to watch

Administrators should verify if their Argo CD installations have the --enable-helm flag enabled for Kustomize builds. Those with the flag active must update to the latest patched versions immediately. Teams should also review application permissions to ensure no users have unnecessary access to application resources.

The fix is available in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Organizations using earlier versions should prioritize upgrading. Monitoring logs for unexpected plugin executions or unusual network connections from the repo-server can help detect exploitation attempts.

What made it possible

This incident illustrates the risks of trusting user-supplied configuration paths in automated delivery tools. When systems allow external inputs to define where executables or plugins are loaded, attackers can redirect these paths to malicious locations. The core weakness is the lack of validation for configuration directories, allowing an attacker to place a malicious plugin in a controlled repository. This technique serves the initial access and execution stages of an intrusion, bypassing traditional permission checks because the system itself loads the malicious code. Teams usually mitigate this by restricting configuration directories to system-managed locations only.

What to do and how to stay safe: Argo CD

• Check if your Argo CD installation enables the --enable-helm flag for Kustomize builds.
• Update Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 if you are running a vulnerable version.
• Review application permissions to ensure users only have necessary access rights, limiting Application get permissions where possible.
• Monitor repository server logs for unexpected plugin executions or unauthorized code activity.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What permissions do I need to exploit this vulnerability?

You only need Application get permission on an existing Application resource. You do not need update, sync, or repository write permissions.

Is my Argo CD installation affected if I don't use Helm?

If you have not enabled the --enable-helm flag for Kustomize builds, your deployment is not affected by this vulnerability.

Which versions of Argo CD contain the fix?

The fix is included in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.