Loading vulnerability…
Unauthenticated RCE in Argo CD repo-server GenerateManifest gRPC endpoint
CVE-2026-15416 is a remote code execution vulnerability in Argo CD affecting the repo-server component. The flaw is exposed through the GenerateManifest gRPC endpoint and stems from missing authentication on a critical function, allowing an unauthenticated attacker with network access to the repo-server interface to execute arbitrary code on the repo-server under certain conditions. The issue is particularly significant in GitOps deployments because compromise of the repo-server can be chained with manipulation of Argo CD cached data in Redis, enabling the attacker to cause deployment of malicious Kubernetes resources to clusters managed by Argo CD. In environments where the required network paths are reachable, this creates a path from repo-server compromise to broader control of managed clusters.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the Argo CD repo-server by an unauthenticated attacker able to reach the vulnerable gRPC interface. Under certain conditions, the attacker can also manipulate cached data used by Argo CD and induce deployment of malicious Kubernetes resources to downstream managed clusters. The resulting impact can include compromise of the Argo CD control plane, unauthorized modification of application manifests and deployment state, high-integrity and confidentiality impact within managed environments, and potential full compromise of affected Kubernetes clusters.
If you can’t patch tonight, do this now.
Restrict network access to the Argo CD repo-server gRPC endpoint to only trusted internal Argo CD components. Do not expose the repo-server outside the cluster or to untrusted network segments. Restrict access to the Redis cache service used by Argo CD, since cache manipulation may be part of the exploitation chain. Enforce Kubernetes NetworkPolicies or equivalent segmentation controls so that arbitrary pods or adjacent network peers cannot reach the repo-server or Redis. Audit Argo CD deployment configurations to verify that internal services are not externally exposed and that only intended components can communicate with them.
Patch, then assume compromise.
Update Argo CD and affected downstream distributions to a fixed version that removes the unauthenticated access path to the vulnerable repo-server functionality. Where vendor-provided fixes are available, apply the relevant product errata or package updates for affected OpenShift GitOps components. Review deployment architecture to ensure the repo-server and associated cache service are not reachable by untrusted workloads or networks. If using affected Helm-based deployments, upgrade to a non-vulnerable chart or release line identified by the vendor.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.