Relative Path Traversal in Argo CD - CVE-2023-40026
Published: September 27, 2023 / Updated: May 2, 2026
Vulnerability identifier: #VU129002
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-40026
CWE-ID: CWE-23
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Argo CD
Argo CD
Software vendor:
Argo
Argo
Description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to relative path traversal in the Argo CD repo-server Helm chart handling when processing a specially crafted Helm file. A remote user can reference external Helm charts handled by the same repo-server to disclose sensitive information.
The issue can expose values or files from other existing Helm charts regardless of permissions because Helm chart paths were predictable.
Remediation
Install security update from vendor's website.