Argo CD repo-server: Jsonnet imports escape the repository root and read service-account tokens

Impact

The repo-server's Jsonnet evaluator does not confine import, importstr or importbin to the repository root, so a .jsonnet file can read any file the repo-server process can read - /proc/self/environ, the projected service-account token, mounted private keys, and the repository credentials for every repo Argo CD manages. Generated Secrets are redacted, but placing the imported content in a ConfigMap hands it straight back to the caller. In a GPU cluster where Argo CD is the thing that deploys the GPU operator, device plugins and tenant workloads, those credentials are the keys to the whole fleet's desired state. importstr against a non-terminating device such as /dev/zero also exhausts repo-server memory and stalls all manifest generation.

Who can reach it

An authenticated Argo CD user with only Application get permission on an existing directory Application, via POST /api/v1/applications/manifestsWithFiles (also reachable through argocd app diff --local --server-side-generate) - no update, sync or repository write permission needed. Alternatively anyone with git push access to a repository an Application tracks; directory Applications evaluate every .jsonnet file in the directory.

What to do

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 and restart argocd-repo-server; no node drain or GPU workload disruption is involved since running workloads are untouched while the control plane rolls. If an upgrade cannot be scheduled immediately, disable the built-in Jsonnet tool per the Argo CD tool-detection documentation. Rotate the repo-server service-account token and any repository credentials that were reachable if you suspect use.

References

Related entries

• Argo CD repo-server: Kustomize ref value injects git --upload-pack and runs commands in the podCVE-2026-113708 · Argo CD argocd-repo-server (Kustomize remote ref passed to git fetch)Critical
• Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes itCVE-2026-113709 · Argo CD argocd-repo-server (Kustomize helmGlobals.configHome plugin loading)Critical
• Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted clusterCVE-2026-41050 · Rancher Fleet Helm deployer (ServiceAccount impersonation)Critical
• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
• RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
• Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical