What’s Vulnerable › Vulnerabilities

CVE-2026-15416: Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

• Severity: high (CVSS 8.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-08-11
• Weakness: CWE-306

Description

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

Affected products

• argoproj argo-helm: before 10.0.0 — fixed in 10.0.0
• Red Hat OpenShift GitOps: all versions
• Red Hat OpenShift GitOps 1.19: all versions — fixed in 1785149260, 1785171339

How to fix

Upgrade to a fixed version: argoproj argo-helm 10.0.0; Red Hat OpenShift GitOps 1.19 1785149260, 1785171339. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:52857
• https://access.redhat.com/security/cve/CVE-2026-15416
• https://bugzilla.redhat.com/show_bug.cgi?id=2496732
• https://github.com/argoproj/argo-helm/commit/0f245ab
• https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
• https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
• https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql

Get alerted when CVE-2026-15416 or the next vulnerability affects your stack