High severity · published Jul 14, 2026
CVE-2026-15416
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
8.9
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenShift GitOps · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift GitOps 1.19 · Red Hat
All versions, or not specified · source: vendor
AR
argo-helm · argoproj
before 10.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15416
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:52857
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-15416
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2496732
github.com
https://github.com/argoproj/argo-helm/commit/0f245ab
github.com
https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
thehackernews.com
https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
More from argo-helm
7.6
CVE-2026-62185
Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
