Unpatched Argo CD Repo-Server RCE Enables Kubernetes Cluster Takeover
Researchers disclosed an unpatched unauthenticated remote code execution flaw in Argo CD’s repo-server that can be exploited through the gRPC GenerateManifest endpoint when attackers can reach the internal service port. The attack chain abuses Argo CD’s handling of Kustomize options, allowing a crafted request to pass attacker-controlled settings such as --enable-helm and --helm-command so code from a malicious Git repository is executed on the repo-server host.
Synacktiv said it reported the issue to Argo CD maintainers in January 2025, but no patch or CVE had been issued at the time of disclosure. After achieving code execution, the researchers demonstrated theft of the REDIS_PASSWORD environment variable and poisoning of Argo CD’s Redis-backed cache to force deployment of attacker-controlled manifests on the next sync, creating a path to full Kubernetes cluster compromise. The reported mitigation is to enforce Kubernetes network policies that restrict access to repo-server and Redis to trusted Argo CD components, as those protections are not enabled by default in common Helm-based deployments.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Synacktiv publicly discloses unpatched Argo CD RCE chain
On July 1, 2026, Synacktiv published technical details of an unpatched Argo CD repo-server attack chain that enables unauthenticated command execution through crafted Kustomize options. The disclosure also described post-exploitation access to Redis, cache poisoning, and potential Kubernetes cluster compromise, while noting no patch or CVE had been issued.
Synacktiv reports Argo CD repo-server flaws to maintainers
Synacktiv said it responsibly disclosed an attack chain in Argo CD's repo-server component to Argo CD maintainers in January 2025. The issue involved unauthenticated remote code execution via the GenerateManifest gRPC endpoint and remained unpatched afterward.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Argo CD ServerSideDiff flaw exposed plaintext Kubernetes Secrets
A critical flaw in Argo CD, tracked as **`CVE-2026-43824`**, exposed plaintext Kubernetes Secrets to low-privileged authenticated users through the `ServerSideDiff` endpoint. The vulnerability was caused by missing authorization and secret-masking protections, allowing the endpoint to return raw `PredictedLive` and `NormalizedLive` data from the Kubernetes API without applying Argo CD’s normal `hideSecretData()` masking. As a result, users with application `get` access could retrieve sensitive values including service account tokens, TLS material, database credentials, and API keys. The risk was heightened when an Application used the annotation `argocd.argoproj.io/compare-options: IncludeMutationWebhook=true`, which bypassed an additional sanitization step and made secret extraction especially effective for resources influenced by mutation webhooks. The issue affected Argo CD versions **3.2.0 through 3.3.8**, and maintainers released fixes in **3.2.11** and **3.3.9**. Administrators were urged to upgrade, tighten RBAC permissions, remove the risky annotation where possible, and review Argo CD API logs for suspicious `ServerSideDiff` activity.
Jun 29, 2026
OpenShift GitOps Privilege Escalation Vulnerability (CVE-2025-13888) Enables Cluster Takeover
A critical vulnerability (CVE-2025-13888) has been identified in OpenShift GitOps, allowing namespace administrators to escalate privileges and potentially take over entire Kubernetes clusters. The flaw enables authenticated attackers to create ArgoCD Custom Resources (CRs) that manipulate the system into granting elevated permissions in other namespaces, including those with privileged access. By leveraging these permissions, attackers can deploy privileged workloads on master nodes, effectively achieving root access across the cluster. Security advisories highlight that this vulnerability is remotely exploitable and poses a significant risk to organizations using OpenShift GitOps. The issue was disclosed by Red Hat, and while specific affected product versions are not detailed, the vulnerability is rated as critical with a CVSS score of 9.1. Organizations are urged to review their OpenShift GitOps deployments and apply mitigations or patches as recommended by the vendor to prevent potential exploitation and cluster compromise.
Jun 29, 2026
Kubernetes CI/CD Flaws in Tekton and Argo Require Immediate Patching
Two newly reported Kubernetes CI/CD vulnerabilities affect **Tekton Pipelines** and **Argo Workflows**, with both issues tied to insufficient validation of user-supplied fields in cluster workflow objects. **CVE-2026-40923** allows a `VolumeMount.mountPath` path restriction bypass in Tekton Pipelines because admission webhooks failed to normalize paths, enabling traversal patterns such as `..`; the fix is to upgrade to **Tekton Pipelines 1.11.1 or later**, which adds `filepath.Clean` logic. **CVE-2026-40886** causes a denial of service in Argo Workflows through unchecked parsing of the `workflows.argoproj.io/pod-gc-strategy` annotation, and is fully patched in **Argo Workflows 3.7.14** and **4.0.5**. Where upgrades cannot be applied immediately, defenders are advised to enforce **Kubernetes admission policies** using **OPA Gatekeeper**, **Kyverno**, or native validating controls to block malicious Tekton `Task` and `TaskRun` requests and to validate incoming Argo `Workflow` annotations. The guidance also calls for tightening **RBAC** so only trusted CI/CD service accounts and authorized personnel can create Tekton resources, restricting namespace access to limit blast radius, and, in Argo environments already forced into a controller crash loop, manually deleting the malicious `Workflow` object from the Kubernetes API so the controller can recover.
Jun 29, 2026