# CVE-2026-62185: Argo CD Helm Chart insecure default network policies

Source: https://junglewise.ai/threats/cve-2026-62185-argo-cd-helm-chart-insecure-default-network-policies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-62185 · Severity: high · CVSS 7.6 · Published 2026-07-13

Argo CD is a popular tool used to automate the deployment of applications to Kubernetes clusters. A security issue in its Helm Chart installation package means that, by default, it does not restrict network traffic between different parts of the cluster. This could allow a malicious or compromised application running in the same environment to access sensitive Argo CD internal services, potentially leading to full cluster takeover and unauthorized code execution.

Vendors: [Argo Project](https://junglewise.ai/threats/vendors/argo-project).

## Quick answers

**Is CVE-2026-62185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62185 being exploited in the wild.

**How severe is CVE-2026-62185?** High severity, with a CVSS score of 7.6, published 13 July 2026.

**Which products and versions are affected?** Argo Project Argo Helm Charts < 10.0.0.

**Is there a fix for CVE-2026-62185?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62185 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-62185?** Check whether you run Argo Project Argo Helm Charts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Argo CD Helm Chart (argo-helm) prior to version 10.0.0 suffers from an insecure default configuration where Kubernetes NetworkPolicies are not created by default. This lack of isolation allows any pod within the cluster to communicate with sensitive internal components such as the repo-server and other Argo APIs. An attacker with low-privileged access to any pod in the adjacent network (the cluster) can leverage this unrestricted access to perform lateral movement. When combined with other attack vectors, this can result in remote code execution (RCE) and full cluster compromise. The issue is resolved in version 10.0.0 by setting 'global.networkPolicy.create' to true by default.

## Affected products

- argoproj argo-helm < 10.0.0

## Timeline

- 2026-06-29: advisory: GitHub Security Advisory published by maintainers
- 2026-07-13: disclosed: NVD publication date

## References

- [https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8](https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8)
- [https://www.vulncheck.com/advisories/argo-cd-helm-chart-missing-network-policy-rce](https://www.vulncheck.com/advisories/argo-cd-helm-chart-missing-network-policy-rce)