8.9

CVE-2026-15416

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerargoproj
≫
Produkt argo-helm
Default Statusunaffected
Version 0
Version < 10.0.0
Status affected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps 1.19
Default Statusaffected
Version 1785149260
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps 1.19
Default Statusaffected
Version 1785171339
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Openshift Data Foundation 4
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunknown
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunknown
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift GitOps
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.2
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.9 2.3 6
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
https://access.redhat.com/security/cve/CVE-2026-15416
https://bugzilla.redhat.com/show_bug.cgi?id=2496732
https://github.com/argoproj/argo-helm/commit/0f245ab
https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql
https://access.redhat.com/errata/RHSA-2026:52857