# Unpatched Unauthenticated RCE in Argo CD Repo-Server via Kustomize GenerateManifest gRPC Endpoint

> Synacktiv disclosed an unauthenticated remote code execution chain in Argo CD's repo-server: an attacker who can reach the unauthenticated GenerateManifest gRPC service injects a malicious --helm-command Kustomize flag pointing to an attacker-controlled Git repository, achieves code execution on repo-server, exfiltrates the Redis password from the pod's environment, and poisons Redis manifest/git-refs cache entries so the next Auto Sync deploys attacker-controlled workloads cluster-wide. Reported to Argo CD maintainers in January 2025, it remained unpatched and unassigned a CVE as of the July 1, 2026 public disclosure.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2423
- **ID:** TL-2026-2423
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-31989

## Description

Argo CD's repo-server component exposes an internal gRPC service, GenerateManifest, that renders Kubernetes manifests from a Git repository using tools such as Kustomize and Helm. Synacktiv found that GenerateManifest performs no authentication — "if you can reach me, you're allowed to ask" — and that the KustomizeOptions.BuildOptions field of a ManifestRequest is passed unsanitized to the kustomize build command line. This allows an attacker who can reach repo-server's gRPC port (8081) to inject arbitrary Kustomize flags, most notably --enable-helm --helm-command <path>, redirecting Kustomize's Helm invocation to an arbitrary attacker-supplied script hosted in the Git repository the attacker specified in the same request.

Once the script executes inside the repo-server process, Synacktiv demonstrated reading the REDIS_PASSWORD environment variable and exfiltrating it over a raw TCP socket using a small Perl script (exfil.pl) or shell script (exfil.sh). With valid Redis credentials, the attacker connects directly to Argo CD's Redis cache (port 6379, unencrypted by default) and overwrites cached entries: mfst|... keys (rendered-manifest cache) are replaced with attacker-chosen Kubernetes manifests, and git-refs|... keys are altered to spoof a newer Git HEAD revision. Because Argo CD verifies cache integrity with an unsecured FNV-64a hash rather than a keyed MAC, the attacker recalculates a matching checksum for the tampered entry, so Argo CD's application-controller accepts it as legitimate. On the next Auto Sync cycle, application-controller — running with the high privileges Argo CD needs to manage target clusters — detects what looks like a newer revision and deploys the poisoned manifest, achieving full cluster compromise from an initially unauthenticated network position.

The flaw compounds a known root cause: default Argo CD Helm chart installations ship with networkPolicy.create set to false, so repo-server and Redis are reachable by any pod in the cluster unless operators explicitly enable NetworkPolicies — the same default-open posture implicated in the earlier CVE-2024-31989 Redis cache-poisoning flaw. Synacktiv reported the new chain to Argo CD maintainers in January 2025; as of the July 1, 2026 disclosure roughly 18 months later, no patch or CVE had been issued. Synacktiv published its research methodology (a custom CodeQL model pack that treats gRPC service methods taking context.Context as remote-flow sources and os/exec Command/CommandContext calls as command-injection sinks) alongside a demonstration PoC repository (hugo-syn/pwn, containing exfil.sh, exfil.pl, pwn.sh, and a malicious kustomization.yaml) and a companion Argo CD test-application repository (hugo-syn/argocd-example-apps). Synacktiv deliberately withheld a separate, more automated exploitation/Redis-interaction tool it calls argo-cdown pending a fix.

Security press and analyst coverage (The Hacker News, Cloud Security Alliance, control-plane.io, CSO Online) emphasized that Argo CD is increasingly used as the deployment control point for MLOps/AI pipelines (Kubeflow pipeline definitions, MLflow model-registry updates, KServe/Seldon inference deployments), meaning cluster-wide manifest poisoning could substitute a malicious container image for a legitimate model-serving deployment, alter feature-store/data-pipeline configuration, or redirect training jobs to attacker-controlled storage. Analysts argued GitOps control planes like Argo CD should be treated as tier-zero infrastructure subject to identity-provider-level access controls, not as an internal utility service.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1552 Unsecured Credentials
- T1048 Exfiltration Over Alternative Protocol
- T1525 Implant Internal Image
- T1565 Data Manipulation
- T1610 Deploy Container

## Sources

- [Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL](https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql.html)
- [Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters](https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html)
- [Internal ≠ Isolated (Or Secure): The Argo CD Repo-Server Flaw](https://control-plane.io/posts/argo-cd-repo-server-rce/)
- [CSA Research Note: Argo CD Repo-Server RCE and GitOps Risk to AI/ML Pipelines](https://labs.cloudsecurityalliance.org/research/csa-research-note-argocd-repo-server-rce-gitops-20260704-csa/)
- [Argo CD flaw shows why GitOps infrastructure should be treated as tier zero](https://www.csoonline.com/article/4192188/argo-cd-flaw-shows-why-gitops-infrastructure-should-be-treated-as-tier-zero.html)
- [Redis or Not - Revealing a Critical Vulnerability in Argo CD Kubernetes Controller (CVE-2024-31989)](https://cycode.com/blog/revealing-argo-cd-critical-vulnerability/)
- [hugo-syn/pwn — Synacktiv PoC exploit scripts (exfil.sh, exfil.pl, pwn.sh, kustomization.yaml)](https://github.com/hugo-syn/pwn)
- [hugo-syn/argocd-example-apps — companion test Application repo for the RCE PoC](https://github.com/hugo-syn/argocd-example-apps/)
- [18 months without a fix: How an Argo CD vulnerability exposed the entire Kubernetes cluster](https://www.cloudmagazin.com/en/2026/07/06/18-months-without-a-fix-how-an-argo-cd-vulnerability-exposed-the-entire/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2423