A critical missing authentication flaw in the Argo CD repo-server (CVE-2026-15416) allows unauthenticated remote code execution via the gRPC GenerateManifest endpoint. An attacker with network access to the repo-server and Redis cache can execute arbitrary code and manipulate cached data to deploy malicious Kubernetes resources, risking complete cluster compromise. Red Hat OpenShift GitOps versions 1.20 and above mitigate this by enabling Kubernetes NetworkPolicies by default, restricting ingress to internal components and preventing the unauthenticated attack path. The vulnerability affects argo-helm versions prior to 10.0.0. Red Hat advises restricting network access to the repo-server and Redis service and applying updates once fixes are available.

The vulnerability enables unauthenticated attackers with network access to the Argo CD repo-server gRPC interface to execute arbitrary code remotely. This can lead to manipulation of cached data and deployment of malicious Kubernetes resources, potentially resulting in complete compromise of Kubernetes clusters managed by Argo CD. The impact includes high confidentiality and integrity loss, with low availability impact. Red Hat OpenShift GitOps versions 1.20 and above are not affected due to default network restrictions.

Red Hat recommends limiting network access to the Argo CD repo-server gRPC endpoint to trusted internal components using Kubernetes NetworkPolicy or equivalent controls. The repo-server should not be exposed outside the cluster or to untrusted networks. Access to the associated Redis service must also be restricted. Users should update to fixed versions once they become available. Red Hat OpenShift GitOps versions 1.20 and 1.21 are not affected due to default Kubernetes NetworkPolicies, so upgrading to these or later versions is an effective mitigation.