Threat reportVulnerabilityTL-2026-4851
Argo CD repo-server unauthenticated RCE via KustomizeOptions --helm-command injection and Redis manifest-cache poisoning (Synacktiv, unpatched, no CVE)
Argo CD repo-server unauthenticated RCE via KustomizeOptions (TL-2026-4851), also tracked as Caught in the Octopus Trap, is a high-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects Argo Project (CNCF) Argo CD repo-server, maps to 5 MITRE ATT&CK techniques (T1059.004, T1190, T1552), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4851
- Threat ID
- TL-2026-4851
- Also known as
- Caught in the Octopus Trap, Argo CD repo-server GenerateManifest RCE, argo-cdown
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, finance, government administration, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Argo CD repo-server unauthenticated RCE via KustomizeOptions
Malware and tooling: argo-cdown
How Argo CD repo-server unauthenticated RCE via KustomizeOptions works
Synacktiv disclosed an unauthenticated code-execution flaw in the Argo CD repo-server: the internal GenerateManifest gRPC endpoint (port 8081) accepts caller-supplied KustomizeOptions.BuildOptions, allowing kustomize's --helm-command to execute an attacker-controlled script. The Redis password recovered from the pod can then be used to poison cached manifests and deploy attacker workloads on the next sync. Reported to maintainers in January 2025; no patch or CVE had been issued at publication, and no in-the-wild exploitation was reported.
Argo CD is a widely deployed Kubernetes GitOps controller. Its repo-server component fetches Git repositories and renders manifests (Helm, Kustomize, plain YAML) for the other Argo CD components. Synacktiv (researcher Hugo Vincent) used a custom CodeQL model pack, which treated gRPC API-method parameters as remote flow sources and os/exec.Command/CommandContext arguments as sinks, to trace tainted data through the roughly 238,000-line Go code base.
The data flow is ManifestRequest -> KustomizeOptions.BuildOptions -> parseKustomizeBuildOptions() -> exec.Command(getBinaryPath(), params...) in kustomize.go. The repo-server gRPC service on TCP 8081 performs no authentication, so any client that can reach the port can call /repository.RepoServerService/GenerateManifest with its own BuildOptions string. Kustomize's Helm chart inflation supports --helm-command, which selects the binary used in place of helm. By pointing a Git repository's kustomization.yaml at a Helm chart and supplying '--enable-helm --helm-command ./exfil.sh' (a script shipped in the attacker-controlled repository, which Argo CD clones into the working directory), the attacker gets command execution inside the repo-server pod. The KustomizeOptions.BinaryPath override also reaches exec but needs cluster-level configuration access.
Second stage: from the repo-server pod the attacker reads the Redis password from an environment variable and connects to Argo CD's Redis (TCP 6379). Redis is typically unauthenticated at the network layer, because network policies are disabled by default in the Helm chart deployment. The attacker adds a malicious Kubernetes manifest (JSON) to a cached 'mfst|...' entry and modifies the 'git-refs|...' entry so that Argo CD sees a new commit SHA. With auto-sync (or a manual sync) the poisoned manifest is deployed with Argo CD's cluster privileges, leading to arbitrary workload deployment and potential cluster takeover. Synacktiv's argo-cdown tool automates the Redis stage (list/get/set data and add-manifest); its public release was withheld to give defenders time to apply network policies.
The flaw was demonstrated against Argo CD v2.13.3; earlier versions are likely affected, and a full version list has not been published. Synacktiv reported it in January 2025 and said repeated follow-ups through GitHub and email went unanswered. Publication followed on 2026-07-01 (the page's '01/07/2026' is DD/MM/YYYY; the hunt skeleton's 2026-01-07 date is a misreading). A separate partial fix covers the Helm chart network-policy misconfiguration (GHSA-47m3-95c7-g2g8, referenced by the researchers; the GitHub advisory page could not be retrieved for verification). Secondary reporting (The Hacker News, Cloud Security Alliance, Control Plane) states there is no patched version and no evidence of active exploitation. The defense is network isolation of the repo-server and Redis. The severity is analyst-assigned, and no CVSS score is published.
MITRE ATT&CK techniques used in TL-2026-4851
Execution
T1059.004 Unix Shell; T1610 Deploy Container
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Impact
Affected products and versions in Argo CD repo-server unauthenticated RCE via KustomizeOptions
- Argo Project (CNCF) — Argo CD repo-server
Vulnerable versions: v2.13.3 (tested); earlier versions likely affected - Argo Project (CNCF) — Argo CD Helm chart (network policies disabled by default)
Vulnerable versions: default deployments
Fixed in: partial fix per GHSA-47m3-95c7-g2g8
Remediation for Argo CD repo-server unauthenticated RCE via KustomizeOptions
Patches
- No patched Argo CD release for the repo-server RCE at publication; monitor the argoproj/argo-cd repository for a fix
- Partial fix for the Helm chart network-policy misconfiguration tracked as GHSA-47m3-95c7-g2g8
Immediate actions
- Enable Kubernetes NetworkPolicies so the repo-server (TCP 8081) and Redis (TCP 6379) are reachable only from Argo CD components (API server, application controller, notifications controller, applicationset controller)
- Run 'kubectl get networkpolicy -A' and confirm an argocd-repo-server network policy exists
- In the Helm chart set networkPolicy.create: true and networkPolicy.defaultDenyIngress: true
- Rotate the Argo CD Redis password and remove it from pod environment variables where possible
Workarounds
- Network isolation of the repo-server and Redis is the only available mitigation
- Review pod network reachability to the Argo CD namespace from other workloads
Longer-term hardening
- Treat GitOps platforms as tier-zero infrastructure with enhanced segmentation
- Enable TLS and authentication for Redis
- Scope AppProjects to restrict permitted source repositories and destinations, and apply least-privilege RBAC to sync service accounts
- Enable audit logging on the repo-server and Redis, and monitor GenerateManifest requests and Redis writes
Weaknesses (CWE) in Argo CD repo-server unauthenticated RCE via KustomizeOptions
Timeline of Argo CD repo-server unauthenticated RCE via KustomizeOptions
- Synacktiv reports the repo-server flaw to the Argo CD maintainers (source gives only 'January 2025'; day not stated, so the 1st is a placeholder)
- Follow-ups via GitHub and email go unanswered, per Synacktiv; exact dates not stated, so this entry is approximate
- The Hacker News and others report the flaw as unpatched, with no evidence of exploitation in the wild
- argo-cdown PoC tool withheld at disclosure to give administrators time to apply network policies; planned for later GitHub release
- Synacktiv publishes 'Caught in the Octopus Trap' detailing the unauthenticated GenerateManifest RCE and the Redis manifest-poisoning chain; no CVE or patch exists
- Cloud Security Alliance publishes a research note on the risk to AI/ML GitOps pipelines and recommends network isolation and audit logging
- Control Plane publishes mitigation and detection guidance: default-deny NetworkPolicy for ports 8081 and 6379, Redis TLS, AppProject scoping
Sources cited for Argo CD repo-server unauthenticated RCE via KustomizeOptions
- Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL (Synacktiv)
- Unpatched Argo CD Repo-Server Flaw (The Hacker News)
- CSA Research Note: Unpatched Argo CD Repo-Server Flaw Threatens AI/ML GitOps Pipelines
- Argo CD repo-server RCE (Control Plane)
- Argo CD Helm chart network policy misconfiguration advisory GHSA-47m3-95c7-g2g8 (cited by Synacktiv; page not retrievable, date is the citing article's)
Detection coverage for TL-2026-4851
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4851 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.