CVE-2026-15416

HIGH

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

Title source: cna

Description

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

References (6)

Core 6

Core References

https://github.com/argoproj/argo-helm/commit/0f245ab

View Patch ZIP pw:eip

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-15416

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2496732

https://bugzilla.redhat.com/show_bug.cgi?id=2496732

https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8

https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html

https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql

Scores

CVSS v3 8.9

EPSS 0.0028

EPSS Percentile 20.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (3)

argoproj/argo-helm < 10.0.0

Red Hat/Red Hat Openshift Data Foundation 4

Red Hat/Red Hat OpenShift GitOps

Published Jul 14, 2026

Tracked Since Jul 14, 2026