CVE-2026-15416 is a remote code execution vulnerability in the Argo CD repo-server used by Red Hat OpenShift GitOps. An unauthenticated attacker with network access to the repo-server's gRPC endpoint can execute arbitrary code. This can lead to manipulation of cached data and deployment of malicious Kubernetes resources, potentially compromising the entire Kubernetes cluster managed by Argo CD. Red Hat OpenShift GitOps versions 1.20 and 1.21 are not affected because Kubernetes NetworkPolicies are enabled by default, restricting ingress to internal components and preventing unauthenticated access. The vulnerability requires network access to both the repo-server gRPC interface and the Redis database. Red Hat advises limiting network access to trusted internal components and not exposing the repo-server outside the cluster. A fixed version is expected but not yet confirmed.

Successful exploitation allows an unauthenticated attacker with network access to the Argo CD repo-server gRPC endpoint to execute arbitrary code remotely. This can lead to deployment of malicious Kubernetes resources, resulting in potential full compromise of the managed Kubernetes clusters. The vulnerability affects confidentiality, integrity, and availability with high impact on confidentiality and integrity and low impact on availability.

Red Hat recommends limiting network access to the Argo CD repo-server gRPC endpoint to trusted internal components using Kubernetes NetworkPolicy or equivalent controls. Do not expose the repo-server outside the cluster or to untrusted networks. Restrict access to the associated Redis service. Update to a fixed version once it becomes available. Red Hat OpenShift GitOps versions 1.20 and 1.21 are not affected due to default network policies. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.