CVE-2026-62185 | Argo CD Helm Chart before 10.0.0 fails to install network po… | CVSS 7.6 HIGH

Description

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

Metadata

CVE ID: CVE-2026-62185
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-13 16:36 UTC
Published: 2026-07-13 21:31 UTC
Last updated: 2026-07-13 21:31 UTC
Primary CWE: CWE-1188
Initialization of a Resource with an Insecure Default
Vendor / Product: argoproj / argo-helm
Sources: cve.org · NVD

Severity & Metrics

7.6 HIGH CVSS 3.1

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products (1)

Vendor	Product	Platform	Versions
argoproj	argo-helm	—	0 < 10.0.0, 10.0.0

Weakness (CWE)

CWE	Source	Description
CWE-1188	cna	Initialization of a Resource with an Insecure Default

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.6	HIGH	4.0	cna	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
7.6	HIGH	3.1	cna	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References (2)

GitHub Security Advisory (GHSA-47m3-95c7-g2g8) https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
VulnCheck Advisory: Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE https://www.vulncheck.com/advisories/argo-cd-helm-chart-missing-network-policy-rce