Unpatched Argo CD Flaw Allows Full Kubernetes Cluster Takeover

Security firm Synacktiv has disclosed an unpatched vulnerability in Argo CD's repo-server component that enables an unauthenticated remote attacker to execute arbitrary code on the service and, from there, seize control of the entire Kubernetes cluster. Argo CD, the widely deployed GitOps tool for Kubernetes, has carried the flaw since at least version v2.13.3, where Synacktiv demonstrated the attack chain. The bug, which has no assigned CVE and no available fix, was first reported to the project's maintainers in January 2025 and went public roughly eighteen months later after no patch materialized.

The flaw sits in repo-server's internal gRPC service, which has no authentication layer, meaning anyone able to reach the port can issue commands. The attack abuses kustomize, a standard tool Argo CD uses to build Kubernetes manifests, by leveraging its --helm-command option to point at an attacker-controlled script pulled from a malicious Git repository. When kustomize runs, it executes the script rather than the legitimate helm binary. To make matters worse, the Helm chart used to install Argo CD ships with networkPolicy.create set to false, so the default deployment leaves repo-server reachable from any pod inside the cluster. Operators should verify exposure with a port scanner and audit active policies using `kubectl get networkpolicy -A`; a hardened install should display one policy per component.

From code execution on repo-server, the attack escalates into full cluster compromise. Synacktiv extracted the Redis password from an environment variable, connected to Argo CD's Redis cache, and poisoned stored deployment data so that the next automatic sync deployed an attacker-supplied workload. This step reopens the logic behind CVE-2024-31989, a 2024 flaw where Argo CD's Redis was left with no password; though that issue was fixed by adding a password, the cache itself remains unsigned, meaning a stolen credential re-enables the same cache-poisoning primitive. Operators managing shared credentials should run them through a password checker and confirm that Redis secrets have not appeared in known exposures using an email and credential breach lookup.

With no patched release available, the only mitigation is network isolation. Enable Argo CD's built-in Kubernetes network policies so only its own components can reach repo-server and Redis, and review Helm chart values to ensure networkPolicy.create is set to true. Until a fix lands, any pod compromise within the cluster should be treated as a precursor to a full takeover, and monitoring should focus on unexpected GenerateManifest requests, outbound calls from repo-server, and any modifications to cached manifests in Redis.