Argo CD: Path traversal in Jsonnet import allows arbitrary file read
Summary
Argo CD evaluates .jsonnet files in the repo-server with an importer that does not restrict import, importstr or importbin to the repository root. An authenticated user who can commit a .jsonnet file to a repository used by an Application, or who has Application get permission on an existing directory Application and can use the upload API, can read any file the repo-server can access. This includes service-account tokens, mounted private keys and repository credentials. Using importstr on a device such as /dev/zero can also exhaust repo-server memory.
Affected
- Argo CD from 0.9.0 up to, but not including, 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2
- The CNA record lists 3.3.1 as the 3.3 fix; the vendor release that contains the fix is 3.3.15
Fixed in
- 3.3.15
- 3.4.10
- 3.5.4
- 3.6.0-rc2
Workaround
- Set jsonnet.enable to 'false' in the argocd-cm ConfigMap. Argo CD then no longer evaluates .jsonnet files.
- Side effect: applications that depend on Jsonnet will stop rendering those manifests.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild found at the time of research.
- No public proof-of-concept found as of 21 Oct 2026 (secondary source, may be outdated).
Our recommendation
- Inventory all Argo CD instances and their versions.
- Update to the fixed release of your minor line (3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 or later).
- If patching is delayed, set jsonnet.enable to 'false' and accept that Jsonnet-based applications stop rendering.
- Restrict repository write access and Application get permissions to trusted users.
- Check whether the Argo CD UI and API are internet-exposed and limit access.
- Monitor for unusual Application uploads and access to sensitive files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m3vr-7329-44ww github.com
- Argo CD release v3.3.15 github.com
- Argo CD release v3.4.10 github.com
- Argo CD release v3.5.4 github.com
- Argo CD release v3.6.0-rc2 github.com
- Argo CD documentation: Disable built-in tools argo-cd.readthedocs.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:13.
Original description (NVD)
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
NVD references (10)
- https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools
- https://github.com/argoproj/argo-cd/commit/27471d524958878e7acc5131fb466b292079cd05
- https://github.com/argoproj/argo-cd/pull/561
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.15
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.10
- https://github.com/argoproj/argo-cd/releases/tag/v3.5.4
- https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.