Argo CD’s Internal Repo-Server Becomes the Blast Radius
Argo CD’s repo-server is not a safe internal helper just because it sits inside the cluster. If something can reach its gRPC port, that reach can become command execution in the component that prepares deployments, and then cluster takeover through Argo CD’s own sync path.
Synacktiv says the flaw is still unpatched about 18 months after it was reported in January 2025. The issue was shown against Argo CD v2.13.3, and the common Helm install leaves repo-server network policies off by default with networkPolicy.create set to false.
That makes location-based trust the weak point. Any Kubernetes stack that treats an internal control-plane service as safe by network position alone can turn one reachable pod into a launch point for the deployment pipeline.