Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes it

Impact

When an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled path. Helm then loads a downloader plugin from <configHome>/.data/plugins with no separate install step and executes its program inside argocd-repo-server as soon as a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data - the GitOps controller that defines the whole GPU fleet's desired state. Deployments that never enabled --enable-helm are not affected, which makes this one worth checking your repo-server flags before scheduling anything.

Who can reach it

An authenticated Argo CD user with only Application get permission on an existing Application, via POST /api/v1/applications/manifestsWithFiles (also reachable through argocd app diff --local --server-side-generate); or anyone with git push access to a repository an Application builds. Both paths additionally require that the operator has already enabled --enable-helm.

What to do

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 and restart argocd-repo-server. As an interim mitigation, disable --enable-helm for kustomize build if your Applications do not need Kustomize-rendered Helm charts; that alone removes both delivery paths. Rolling the repo-server does not disturb running GPU workloads.

References

Related entries

• Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted clusterCVE-2026-41050 · Rancher Fleet Helm deployer (ServiceAccount impersonation)Critical
• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
• RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
• Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical
• Dokploy: authenticated members inject shell commands into deploy and backup paths and get host rootCVE-2026-72736 · Dokploy (shell command construction in deploy, backup, git and destination endpoints)Critical
• Dokploy: WebSocket terminals authenticate but never authorize, giving any member a root shell in any containerCVE-2026-72863 · Dokploy WebSocket handlers (container terminal and log streaming)Critical