Argo CD Helm Chart versions prior to 10.0.0 install without a default network policy, which allows any pod within the cluster to reach the repo-server and other Argo control plane APIs. This unprotected network access can be leveraged in combination with other vulnerabilities to execute commands on the control plane or compromise the entire cluster. The vulnerability is a classic example of missing network isolation leading to potential remote code execution.

The affected product is the Argo CD Helm Chart, specifically the argoproj:argo-helm package. Any deployment of this chart with a version lower than 10.0.0 is impacted. No further sub‑version details are specified, so installations <10.0.0 should be considered vulnerable.

The CVSS score of 8.6 classifies this issue as high severity. The EPSS score is <1%, indicating a very low exploitation probabilityISA KEV, so it has not yet been broadly exploited. Attackers would need initial ingress into the cluster or existing pod network access; from there they can use the missing network policy to reach the repo-server, potentially executing arbitrary code or escalating privileges. The risk is significant for environments where pod-to-pod communication is unrestricted and there is no external firewall or segmentation in place.