Vulnerabilities · 74 days ago
Argo CD’s repo-server is not a safe internal helper just because it sits inside the cluster. If something can reach its gRPC port, that reach can become command execution in the component that prepares deployments, and then cluster takeover through Argo CD’s own sync path.
Synacktiv says the flaw is still unpatched about 18 months after it was reported in January 2025. The issue was shown against Argo CD v2.13.3, and the common Helm install leaves repo-server network policies off by default with networkPolicy.create set to false.
That makes location-based trust the weak point. Any Kubernetes stack that treats an internal control-plane service as safe by network position alone can turn one reachable pod into a launch point for the deployment pipeline.
2 sources covering this story
Argo CD flaw shows why GitOps infrastructure should be treated as tier zero
The unpatched vulnerability could give attackers a pathway from a compromised pod to broader control over Kubernetes deployments.
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Synacktiv says attackers who reach Argo CD's internal gRPC port can run commands, with network policies the main defense.
Part of the PlainSec briefing for 2026-07-03