UpHeron
All vulnerabilities

Servers and applications

CVE-2023-40026

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Severity
Medium 4.3
Published
27 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.0, 2.3
Also known as
GHSA-6jqw-jwf5-rp8h
Sources
NVD, Project advisories (GitHub)

Description

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any version using Helm before 2.3), using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was possible because Helm paths were…

Affected software

SoftwareAffected versions
Argo CDServers and applications · cpe:a:argoproj:argo_cd
  • Every version before 2.3.0
Argo CDServers and applications · github:argoproj/argo-cd
  • Every version before 2.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-40026
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-40026
  • GitHub Advisory Database https://github.com/advisories/GHSA-6jqw-jwf5-rp8h
  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-6jqw-jwf5-rp8h