Technical impact
A flaw in Argo CD allows an unauthenticated attacker with network access to the repo‑server’s gRPC endpoint to execute arbitrary code. The weakness stems from a lack of authentication enforcement (CWE‑306). Once control is achieved, the attacker can tamper with cached data to cause the deployment of malicious Kubernetes resources, potentially leading to full cluster compromise by executing malicious code or configurations.
Affected Systems
The vulnerability affects Red Hat OpenShift GitOps and OpenShift Data Foundation 4 deployments, as well as the argoproj/argo‑helm chart. No specific patch version is indicated; any instance of Argo CD that has not received a vendor update is considered vulnerable.
Risk and Exploitability
The CVSS base score of 8.9 signals a high severity impact. An EPSS score of less than 1 % indicates the exploit is not yet common in the wild, and the flaw is not listed in CISA’s KEV catalog. Attackers only require network connectivity to the repo‑server gRPC endpoint (and often access to Redis) and no credentials, making the attack vector straightforward for anyone able to reach those services from within the cluster or an exposed network.
