VulnerabilitiesJul 1, 2026

Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

Unpatched Argo CD repo-server flaw allows unauthenticated attackers to take over Kubernetes clusters.

A critical unpatched vulnerability in Argo CD's repo-server component allows unauthenticated attackers to execute arbitrary code, potentially leading to a full Kubernetes cluster takeover. The flaw, discovered by Synacktiv, abuses a kustomize option to run attacker-controlled scripts. While Argo CD maintainers were notified in January 2025, no fix is available, and the vulnerability has not been assigned a CVE.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Synacktiv?

Get an email when a new story names Synacktiv, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

A critical vulnerability in Argo CD's repo-server component allows unauthenticated attackers to execute arbitrary code by abusing a kustomize configuration option to run attacker-controlled scripts. With no patch or CVE assigned yet, organizations relying on Argo CD for Kubernetes GitOps workflows remain exposed indefinitely. This highlights the danger of zero-day gaps in widely-used infrastructure tooling, where a single component compromise can escalate to full cluster control. The lack of a CVE further hampers defenders by reducing automated detection and prioritization by vulnerability scanners.

What helps against this

How we list vendors

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleHuntress Managed ITDR CrowdStrike Falcon Identity Protection Microsoft Defender for Identity all options
Automated patch management
Known holes get closed in days, not months.
For exampleAction1 Patch Management Microsoft Intune ManageEngine Patch Manager Plus all options
Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
For exampleIllumio Segmentation ThreatLocker Zero Trust Endpoint Firewall Akamai Guardicore Segmentation all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

mitre_attack — T1059.004
mitre_attack — T1505.003
mitre_attack — T1071.004
mitre_attack — T1531

Entities

Argo CD (product)Kubernetes (technology)Synacktiv (vendor)kustomize (technology)gRPC (technology)Redis (technology)