What is the CVSS score of CVE-2026-15416?

CVE-2026-15416 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Argo CD are affected by CVE-2026-15416?

Argo CD repo-server deployments in Red Hat OpenShift GitOps and via argoproj argo-helm chart are vulnerable to unauthenticated remote code execution (CVE-2026-15416), allowing attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-15416?

Within 24 hours: Conduct inventory of all Argo CD deployments using vulnerable distributions (Red Hat OpenShift GitOps, argoproj argo-helm chart) and verify which instances are network-accessible; implement immediate network segmentation to restrict access to the repo-server component to trusted sources only, and enable detailed logging of all repo-server API calls. Within 7 days: Deploy intrusion detection signatures for exploitation attempts targeting the repo-server component; audit recent deployment manifests for unauthorized changes; and prepare rollback procedures for all active Kubernetes clusters. Within 30 days: Monitor Red Hat Security Advisories and argoproj/argo-helm repositories for vendor-released patches; apply patches immediately upon release to all affected instances; verify patch deployment through cluster audit logs.

Argo CD CVE-2026-15416

EUVD-2026-43648 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-14 redhat

Authentication Bypass RCE Kubernetes Red Hat Red Hat Openshift Data Foundation 4 Red Hat Openshift Gitops Argo Helm Self Service Automation Portal 2 Argoproj Red Hat

8.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.9 HIGH

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.6 CRITICAL

CWE-306 and the 'unauthenticated' description drive PR:N (vs vendor PR:L); repo-server is an internal service so AV:A, and RCE plus cross-cluster resource deployment give S:C with C/I/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.9 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 14, 2026 - 11:17 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 09:32 vuln.today

Analysis Generated

Jul 14, 2026 - 09:32 vuln.today

CVE Published

Jul 14, 2026 - 08:56 nvd

HIGH 8.9

DescriptionCVE.org

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

Articles & Coverage 1

News 5 New Kubernetes Vulnerabilities - 5 High Severity Jul 15, 2026

AnalysisAI

Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.

Technical ContextAI

Argo CD is a widely used declarative GitOps continuous-delivery controller for Kubernetes. Its repo-server is an internal microservice (typically gRPC) that clones Git repositories and renders manifests (Helm/Kustomize/plain YAML) before the application controller applies them to target clusters. The vulnerability class is CWE-306 (Missing Authentication for a Critical Function): the repo-server performs security-critical rendering work without authenticating the caller, so any party able to reach it on the cluster network can drive it. Because rendered output is cached and subsequently reconciled to managed clusters, compromising repo-server or its cache directly translates into control over what gets deployed. The affected surface spans the upstream argoproj/argo-helm chart plus Red Hat's downstream packaging in OpenShift GitOps and OpenShift Data Foundation 4.

RemediationAI

The primary hardening shipped is argo-helm chart 10.0.0 (commit 0f245ab), which flips global.networkPolicy.create from false to true so NetworkPolicy objects are created for all components by default, restricting who can reach the repo-server; upgrade the chart to 10.0.0 or, if you cannot upgrade, immediately set global.networkPolicy.create=true in your values.yaml (or author equivalent NetworkPolicies) to allow ingress to the repo-server only from the Argo CD application-controller and server pods. Be aware of the documented trade-off: environments using a service mesh or a CNI-specific policy type such as CiliumNetworkPolicy may need to keep chart-managed policies off and implement the restriction themselves rather than double-managing policies. Apply Red Hat OpenShift GitOps / OpenShift Data Foundation 4 updates as they are released (track https://access.redhat.com/security/cve/CVE-2026-15416 and GHSA-47m3-95c7-g2g8), since press reporting indicated the flaw was unpatched at disclosure and a released fixed Argo CD version is not independently confirmed here. As additional compensating controls, ensure the repo-server is never exposed via LoadBalancer/Ingress, segment the cluster network so untrusted workloads cannot reach it, and monitor for anomalous manifests being reconciled to managed clusters.