Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Summary: Synacktiv found an unpatched flaw in Argo CD's repo-server whose internal gRPC service has no authentication, letting an unauthenticated attacker who can reach that port run code and potentially take over the cluster; it reported the bug to maintainers in January 2025 and published details roughly eighteen months later with no fix and no CVE. The attack abuses kustomize's --helm-command option through the GenerateManifest service to execute a script from an attacker-controlled Git repository, and Synacktiv notes the Helm chart sets networkPolicy.create to false, leaving the policies that would wall off repo-server disabled by default.
Bottom line: Once on the repo-server, an attacker can read the Redis password from an environment variable, poison the deployment cache, and have Argo CD deploy an attacker-supplied workload on the next automatic sync - reviving CVE-2024-31989 because the cache is still not signed. With no patch available, the only defense is confirming network policies are actually active; a healthy install shows one per component, including repo-server and Redis.
Read the original at The Hacker News ↗
- Mentions
- CVE-2024-31989CVE-2025-55190CVE-2026-42880
- Related