CVE-2026-15416

HIGH 8.9

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

CVSS Score

8.9

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

CWE	CWE-306
Vendor	argoproj
Product	argo-helm
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for argoproj argo-helm

Be the first to know when new high vulnerabilities affecting argoproj argo-helm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

argoproj / argo-helm

0 < 10.0.0

Red Hat / Red Hat Openshift Data Foundation 4

All versions affected