[redis-ha] HAProxy image 3.3.10-alpine carries 3 critical CVEs; no bot tracks the image tags #423

Activity

1. JanWelker commented on Sep 18, 2026

   

   JanWelker

   on Sep 18, 2026

   Author

   More actions

   Worth recording the blast radius here, because it is larger than this repo: this pin ships inside the Argo CD chart, and Argo CD users cannot patch it from their own values without knowing the trick below.

   argo-cd declares redis-ha as a dependency, but the published release tarball vendors the subchart rather than resolving it at install time:

   $ tar tzf argo-cd-10.9.2.tgz | grep charts/redis-ha/Chart.yaml
   argo-cd/charts/redis-ha/Chart.yaml
   
   $ tar xzf argo-cd-10.9.2.tgz -O argo-cd/charts/redis-ha/Chart.yaml | grep ^version
   version: 4.38.0
   

   So Argo CD 10.9.2 carries redis-ha 4.38.0, haproxy.image.tag: 3.3.10-alpine, and the affected HAProxy is what every Argo CD HA install actually runs. Nothing reaches out to this repo's Helm index at render time, which means the usual escape hatches do not apply — there is no repository to redirect, and forking this chart does not help unless you also stop using the Argo CD chart's redis-ha.enabled path entirely.

   Workaround for Argo CD users

   The tag is a plain values field, so it can be overridden through the parent chart's redis-ha key without forking anything:

   redis-ha:
     haproxy:
       image:
         tag: 3.3.14-alpine

   Verified against argo-cd-10.9.2.tgz:

   $ helm template argocd argo-cd-10.9.2.tgz -f values.yaml | grep haproxy
   image: ecr-public.aws.com/docker/library/haproxy:3.3.14-alpine
   

   I diffed the vendored 4.38.0 values.yaml against the fixed chart to confirm the override is sufficient and not papering over other drift — the HAProxy tag is the entire functional delta:

   140c140
   <     tag: 3.3.10-alpine
   ---
   >     tag: 3.3.14-alpine

   This is a stopgap, not a fix: it leaves every Argo CD user who has not read this thread on the vulnerable image. The real fix is #424 landing and Argo CD picking up the new chart version.