CVE-2026-15416
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
argo-helm
- Vendor
- argoproj
- Product
- argo-helm
- Platforms
- Unknown
- Default status
unaffected- Package
- argo-helm
- Package collection
- https://github.com/argoproj/argo-helm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 10.0.0 | Unavailable | None listed |
Red Hat OpenShift GitOps 1.19
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.19
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/argocd-rhel8
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1785149260 | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift GitOps 1.19
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.19
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1785171339 | unaffected | rpm | * | Unavailable | None listed |
Red Hat Openshift Data Foundation 4
- Vendor
- Red Hat
- Product
- Red Hat Openshift Data Foundation 4
- Platforms
- Unknown
- Default status
unaffected- Package
- odf4/odf-multicluster-rhel9-operator
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unknown- Package
- openshift-gitops-1/argocd-agent-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unaffected- Package
- openshift-gitops-1/argocd-agent-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/argocd-image-updater-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unaffected- Package
- openshift-gitops-1/argocd-image-updater-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unknown- Package
- openshift-gitops-1/argocd-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-operator-bundle
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unaffected- Package
- openshift-gitops-1/gitops-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unaffected- Package
- openshift-gitops-1/gitops-rhel9-operator
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.