CVE-2026-113672
Description
A flaw was found in Argo CD. When processing Jsonnet files, the application does not restrict file imports to the intended repository, allowing files outside of it to be read. This can lead to disclosure of sensitive information, such as credentials and access tokens, and may also result in a denial of service.
Mitigation
This flaw can be mitigated by disabling Jsonnet processing in the repo-server. Set the following key in the `argocd-cm` ConfigMap in the namespace where Argo CD / Red Hat OpenShift GitOps is installed:
jsonnet.enable: "false"
With this setting Argo CD skips all `.jsonnet` files, closing both attack vectors (a `.jsonnet` file committed to a Git repository and one uploaded via `POST /api/v1/applications/manifestsWithFiles`). YAML and JSON manifests in a directory Application continue to be applied.
Note: this workaround is not transparent to Jsonnet users. Applications that rely on Jsonnet will stop rendering those files — the manifests are omitted rather than rejected, so a directory Application containing only Jsonnet will sync without those manifests. Review affected Applications before applying.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 9.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
