Unpatched Unauthenticated RCE in Argo CD Repo-Server via Kustomize GenerateManifest gRPC Endpoint

Unpatched Unauthenticated RCE in Argo CD Repo-Server via (TL-2026-2423), also tracked as Caught in the Octopus Trap, is a high-severity software vulnerability, first published 2026-07-01. It has no confirmed attribution, affects Argo Project (CNCF) Argo CD, maps to 8 MITRE ATT&CK techniques (T1048, T1059, T1190), and is covered by 9 detection rules and 9 indicators of compromise.

Key facts for TL-2026-2423

Threat ID
TL-2026-2423
Also known as
Caught in the Octopus Trap, Argo CD GenerateManifest RCE
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology
Target regions
Global
Detection rules
9
Indicators of compromise
9

Malware and tooling in Unpatched Unauthenticated RCE in Argo CD Repo-Server via

Malware and tooling: argo-cdown

Synacktiv disclosed an unauthenticated remote code execution chain in Argo CD's repo-server: an attacker who can reach the unauthenticated GenerateManifest gRPC service injects a malicious --helm-command Kustomize flag pointing to an attacker-controlled Git repository, achieves code execution on repo-server, exfiltrates the Redis password from the pod's environment, and poisons Redis manifest/git-refs cache entries so the next Auto Sync deploys attacker-controlled workloads cluster-wide. Reported to Argo CD maintainers in January 2025, it remained unpatched and unassigned a CVE as of the July 1, 2026 public disclosure.

How Unpatched Unauthenticated RCE in Argo CD Repo-Server via works

Argo CD's repo-server component exposes an internal gRPC service, GenerateManifest, that renders Kubernetes manifests from a Git repository using tools such as Kustomize and Helm. Synacktiv found that GenerateManifest performs no authentication — "if you can reach me, you're allowed to ask" — and that the KustomizeOptions.BuildOptions field of a ManifestRequest is passed unsanitized to the kustomize build command line. This allows an attacker who can reach repo-server's gRPC port (8081) to inject arbitrary Kustomize flags, most notably --enable-helm --helm-command <path>, redirecting Kustomize's Helm invocation to an arbitrary attacker-supplied script hosted in the Git repository the attacker specified in the same request.

Once the script executes inside the repo-server process, Synacktiv demonstrated reading the REDIS_PASSWORD environment variable and exfiltrating it over a raw TCP socket using a small Perl script (exfil.pl) or shell script (exfil.sh). With valid Redis credentials, the attacker connects directly to Argo CD's Redis cache (port 6379, unencrypted by default) and overwrites cached entries: mfst|... keys (rendered-manifest cache) are replaced with attacker-chosen Kubernetes manifests, and git-refs|... keys are altered to spoof a newer Git HEAD revision. Because Argo CD verifies cache integrity with an unsecured FNV-64a hash rather than a keyed MAC, the attacker recalculates a matching checksum for the tampered entry, so Argo CD's application-controller accepts it as legitimate. On the next Auto Sync cycle, application-controller — running with the high privileges Argo CD needs to manage target clusters — detects what looks like a newer revision and deploys the poisoned manifest, achieving full cluster compromise from an initially unauthenticated network position.

The flaw compounds a known root cause: default Argo CD Helm chart installations ship with networkPolicy.create set to false, so repo-server and Redis are reachable by any pod in the cluster unless operators explicitly enable NetworkPolicies — the same default-open posture implicated in the earlier CVE-2024-31989 Redis cache-poisoning flaw. Synacktiv reported the new chain to Argo CD maintainers in January 2025; as of the July 1, 2026 disclosure roughly 18 months later, no patch or CVE had been issued. Synacktiv published its research methodology (a custom CodeQL model pack that treats gRPC service methods taking context.Context as remote-flow sources and os/exec Command/CommandContext calls as command-injection sinks) alongside a demonstration PoC repository (hugo-syn/pwn, containing exfil.sh, exfil.pl, pwn.sh, and a malicious kustomization.yaml) and a companion Argo CD test-application repository (hugo-syn/argocd-example-apps). Synacktiv deliberately withheld a separate, more automated exploitation/Redis-interaction tool it calls argo-cdown pending a fix.

Security press and analyst coverage (The Hacker News, Cloud Security Alliance, control-plane.io, CSO Online) emphasized that Argo CD is increasingly used as the deployment control point for MLOps/AI pipelines (Kubeflow pipeline definitions, MLflow model-registry updates, KServe/Seldon inference deployments), meaning cluster-wide manifest poisoning could substitute a malicious container image for a legitimate model-serving deployment, alter feature-store/data-pipeline configuration, or redirect training jobs to attacker-controlled storage. Analysts argued GitOps control planes like Argo CD should be treated as tier-zero infrastructure subject to identity-provider-level access controls, not as an internal utility service.

MITRE ATT&CK techniques used in TL-2026-2423

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1059 Command and Scripting Interpreter; T1610 Deploy Container

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1525 Implant Internal Image

Credential Access

T1552 Unsecured Credentials

Impact

T1565 Data Manipulation

Resource Development

T1608 Stage Capabilities

Affected products and versions in Unpatched Unauthenticated RCE in Argo CD Repo-Server via

  • Argo Project (CNCF) — Argo CD
    Vulnerable versions: Demonstrated against v2.13.3; Synacktiv did not publish a full affected-version list and no patched release exists as of disclosure

Remediation for Unpatched Unauthenticated RCE in Argo CD Repo-Server via

Immediate actions

  • Enable Kubernetes NetworkPolicy with default-deny ingress restricting repo-server (gRPC port 8081) and Redis (port 6379) to only the Argo CD components that require them — the official Helm chart ships with networkPolicy.create: false, leaving both ports open to any pod in the cluster by default.
  • Verify enforcement with `kubectl get networkpolicy -A` and confirm an argocd-repo-server-network-policy exists restricting access to the API server, application-controller, and notification components only.
  • Rotate the Redis password and audit whether it is exposed to the repo-server pod via a plaintext environment variable rather than a mounted secret file.
  • Reduce or disable Auto Sync while unpatched to shrink the automatic-reconciliation window that turns cache poisoning into cluster-wide deployment.

Workarounds

  • Treat any Argo CD deployment lacking repo-server/Redis network isolation as equivalent to having an unauthenticated code-execution path into the cluster, regardless of external network exposure.
  • Restrict which Git repositories and AppProjects can be targeted by GenerateManifest requests rather than relying on the shared default AppProject.

Longer-term hardening

  • Reclassify GitOps control-plane components (repo-server, Redis, application-controller) as tier-zero infrastructure requiring identity-provider-level access review, per industry commentary following this disclosure.
  • Run dedicated, network-segmented Argo CD instances for AI/ML (MLOps) infrastructure rather than sharing one multi-tenant instance across general application delivery and model-deployment pipelines.
  • Enable TLS and authentication on the Redis cache and avoid injecting its credential via pod environment variables.
  • Adopt least-privilege sync service accounts for application-controller instead of cluster-admin-equivalent permissions, limiting blast radius if cache poisoning succeeds.

Weaknesses (CWE) in Unpatched Unauthenticated RCE in Argo CD Repo-Server via

CWE-306, CWE-78, CWE-522

Timeline of Unpatched Unauthenticated RCE in Argo CD Repo-Server via

  • Cycode Labs reports CVE-2024-31989 (unauthenticated Redis in Argo CD enabling manifest cache-poisoning cluster takeover) to Argo CD maintainers — the same cache-poisoning surface later abused in the 2026 repo-server RCE chain.
  • Argo CD ships v2.8.19/2.9.15/2.10.10/2.11.1 fixing CVE-2024-31989 by requiring a Redis password — the very credential the 2026 exploit chain exfiltrates from repo-server's environment variables to reach the same cache.
  • Synacktiv privately reports the unauthenticated GenerateManifest/Kustomize --helm-command RCE chain to Argo CD project maintainers.
  • CVE-2025-55190 published: Argo CD read-access API tokens can be abused to extract Git repository credentials, another credential-exposure flaw disclosed while the RCE chain sat unpatched.
  • CVE-2026-42880 published: read-only Argo CD users can access plaintext Kubernetes Secrets, a further secrets-exposure flaw in the same product line.
  • CSO Online publishes analysis arguing GitOps control planes (repo-server, Redis, application-controller) must be treated as tier-zero infrastructure, quoting that 'any pod that can reach it becomes equivalent to an authenticated attacker.'
  • The Hacker News publishes coverage warning the unpatched flaw threatens AI/ML GitOps pipelines (Kubeflow, MLflow, KServe/Seldon) built on Argo CD.
  • Synacktiv publishes 'Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL,' detailing the full exploit chain 18 months after private disclosure, with the vulnerability still unpatched and no CVE assigned.
  • Cloud Security Alliance publishes a research note specifically analyzing the flaw's risk to MLOps/AI-ML GitOps deployment pipelines.
  • cloudmagazin.com publishes '18 months without a fix,' summarizing the disclosure timeline and unresolved risk to Kubernetes clusters.

Sources cited for Unpatched Unauthenticated RCE in Argo CD Repo-Server via

More in vulnerability

Detection coverage for TL-2026-2423

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2423 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats