kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the online demo source...

kube-linter

Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...

CVE-2026-113708

A flaw was found in Argo CD, where a crafted Kustomize remote base URL can inject options into a Git command run by the repo-server. This allows an attacker to execute arbitrary commands inside argocd-repo-server and read repository credentials and other data accessible to that process...

CVE-2026-113709

A flaw was found in Argo CD, where a Kustomize kustomization can point Helm at a repository-controlled directory and load a plugin that runs when Kustomize Helm rendering is enabled in the repo-server. This allows an attacker to execute arbitrary commands inside argocd-repo-server and read...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

EUVD-2026-105250

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709

In Argo CD versions 2.1.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, a vulnerability exists when the --enable-helm flag is used for kustomize build . If helmGlobals.configHome points to a repository-controlled location, Helm automatically loads and executes downloader plugins from a directory ...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

CVE-2026-113708

Argo CD versions 2.7.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are vulnerable to command injection in the argocd-repo-server component. The root cause is that Kustomize passes ref or version query values from remote URLs to git fetch without an end-of-options separator. An attacker can provide...

CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

EUVD-2026-105249

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

Argo Project Argo CD Command Injection Vulnerability

The Argo CD versions from 2.7.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 have a command injection vulnerability. This vulnerability arises due to Kustomize failing to use an option end separator when passing query values for ref or version from remote...

PT-2026-118599

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.7.0 through 3.3.14 Argo CD versions 3.4.0 through 3.4.9 Argo CD versions 3.5.0 through 3.5.3 Argo CD versions 3.6.0-rc0 through 3.6.0-rc1 Description Kustomize passes ref or version query values from remote resource, base, o...