Argo CD repo-server: Kustomize ref value injects git --upload-pack and runs commands in the pod

Impact

Kustomize passes the ref or version query value from a remote resource, base or component URL to git fetch without an end-of-options separator, so a leading-hyphen value is parsed as --upload-pack and executes a command inside argocd-repo-server. The transport must be local (file://), which means blocking repo-server egress does not stop it. The command runs as the repo-server user and can read repository credentials and other process-accessible data, with output returned through manifest-generation errors. For a GPU cluster this is code execution in the component that renders every manifest the fleet applies, including the GPU operator and tenant workloads. Note that swapping in a newer Kustomize is not a fix: 5.0.0 is what started accepting file://, and the missing option separator remains.

Who can reach it

An authenticated Argo CD user with only Application get permission on an existing Application, via POST /api/v1/applications/manifestsWithFiles (also reachable through argocd app diff --local --server-side-generate) - no update, sync or repository write permission needed. Alternatively anyone with git push access to a repository an Application builds.

What to do

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 and restart argocd-repo-server. Replacing the bundled Kustomize version is explicitly not sufficient. Rolling the repo-server does not disturb running GPU workloads. Rotate repository credentials held by the repo-server if you suspect exploitation.

References

Related entries

• Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes itCVE-2026-113709 · Argo CD argocd-repo-server (Kustomize helmGlobals.configHome plugin loading)Critical
• Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted clusterCVE-2026-41050 · Rancher Fleet Helm deployer (ServiceAccount impersonation)Critical
• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
• RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
• Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical
• Dokploy: authenticated members inject shell commands into deploy and backup paths and get host rootCVE-2026-72736 · Dokploy (shell command construction in deploy, backup, git and destination endpoints)Critical