CVE-2026-15416CWE-306

CVE-2026-15416

High · published July 14, 2026

CVSS v3.1
8.9
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-14T13:16Z
References (7)
https://access.redhat.com/errata/RHSA-2026:52857 · [email protected]https://access.redhat.com/security/cve/CVE-2026-15416 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2496732 · [email protected]https://github.com/argoproj/argo-helm/commit/0f245ab · [email protected]https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8 · [email protected]https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html · [email protected]https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql · [email protected]
EPSS history
Timeline
  • 14 JUL 08:56Z
    Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
    cvelistv5