Synacktiv: unauthenticated code execution in Argo CD with no official fix

Synacktiv has disclosed a vulnerability in the repo-server component of Argo CD, after reporting it to the maintainers in January 2025. The flaw sits in an exposed internal gRPC service that accepts crafted requests, causing kustomize to execute an attacker-controlled script from a supplied Git repository. Synacktiv demonstrated the issue against Argo CD v2.13.3 and stated at publication on 1 July 2026 that no official patch was available. The recommended control is strict Kubernetes network policy isolating repo-server and Redis.

What this means for your organisation

Argo CD is the deployment mechanism in many Kubernetes environments, and therefore holds the privileges needed to change everything that runs. Full cluster compromise effectively means an attacker can alter your production code without touching the source repository. With no patch available, this is an architecture problem to be solved through segmentation rather than a patching schedule.

Berigo recommends

• Apply Kubernetes network policy isolating repo-server and Redis from everything other than Argo CD's own components.
• Verify that no Argo CD component is reachable outside the cluster, either directly or through a service mesh.
• Monitor deployment changes that have no corresponding trace in Git, and alert on discrepancies.
• Follow the maintainers' channels closely and plan the update for the moment a fix appears.

Source

• synacktiv.com