Unpatched Argo CD Vulnerability Enables Remote Code Execution in Kubernetes Clusters

A newly disclosed vulnerability in Argo CD's repo-server component allows unauthenticated attackers to execute remote code and potentially take over Kubernetes clusters. The flaw, which affects the GenerateManifest gRPC endpoint, enables attackers to inject malicious Kustomize options through crafted requests. Security firm Synacktiv reported that exploitation requires access to the repo-server and Redis database ports, which should not be exposed to users. However, default configurations in Helm chart deployments do not enable necessary Kubernetes network policies, increasing risk. The vulnerability remains unpatched as of July 2, 2026, and organizations are advised to implement strict network policies to mitigate risks. This incident highlights the importance of treating GitOps infrastructure as tier zero. The vulnerability was first reported to Argo CD maintainers in January 2025.

Key Points: • Argo CD's repo-server vulnerability allows unauthenticated remote code execution. • Exploitation requires access to internal gRPC and Redis database ports. • The vulnerability remains unpatched, with recommendations for strict network policies.