CVE-2026-15416
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
- State
- Published
- Severity
- 8.9 High
- Published
- Jul 14, 2026
- Updated
- Aug 11, 2026
- Reserved
- Jul 10, 2026
Description
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.9 High | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L | redhat |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
argo-helmargoproj |
|
Red Hat OpenShift GitOps 1.19Red Hat |
|
Red Hat OpenShift GitOps 1.19Red Hat |
|
Red Hat Openshift Data Foundation 4Red Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat | |
Red Hat OpenShift GitOpsRed Hat |
References
- RHSA-2026:52857vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-15416vdb-entry
- RHBZ#2496732issue-tracking
- https://github.com/argoproj/argo-helm/commit/0f245ab
- https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
- https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
- https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.