# Argo CD repo-server unauthenticated RCE via KustomizeOptions --helm-command injection and Redis manifest-cache poisoning (Synacktiv, unpatched, no CVE)

> Synacktiv disclosed an unauthenticated code-execution flaw in the Argo CD repo-server: the internal GenerateManifest gRPC endpoint (port 8081) accepts caller-supplied KustomizeOptions.BuildOptions, allowing kustomize's --helm-command to execute an attacker-controlled script. The Redis password recovered from the pod can then be used to poison cached manifests and deploy attacker workloads on the next sync. Reported to maintainers in January 2025; no patch or CVE had been issued at publication, and no in-the-wild exploitation was reported.

- **Published:** 2026-10-30T19:43:12Z
- **Last reviewed:** 2026-10-30T19:43:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4851
- **ID:** TL-2026-4851
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Argo CD is a widely deployed Kubernetes GitOps controller. Its repo-server component fetches Git repositories and renders manifests (Helm, Kustomize, plain YAML) for the other Argo CD components. Synacktiv (researcher Hugo Vincent) used a custom CodeQL model pack, which treated gRPC API-method parameters as remote flow sources and os/exec.Command/CommandContext arguments as sinks, to trace tainted data through the roughly 238,000-line Go code base.

The data flow is ManifestRequest -> KustomizeOptions.BuildOptions -> parseKustomizeBuildOptions() -> exec.Command(getBinaryPath(), params...) in kustomize.go. The repo-server gRPC service on TCP 8081 performs no authentication, so any client that can reach the port can call /repository.RepoServerService/GenerateManifest with its own BuildOptions string. Kustomize's Helm chart inflation supports --helm-command, which selects the binary used in place of helm. By pointing a Git repository's kustomization.yaml at a Helm chart and supplying '--enable-helm --helm-command ./exfil.sh' (a script shipped in the attacker-controlled repository, which Argo CD clones into the working directory), the attacker gets command execution inside the repo-server pod. The KustomizeOptions.BinaryPath override also reaches exec but needs cluster-level configuration access.

Second stage: from the repo-server pod the attacker reads the Redis password from an environment variable and connects to Argo CD's Redis (TCP 6379). Redis is typically unauthenticated at the network layer, because network policies are disabled by default in the Helm chart deployment. The attacker adds a malicious Kubernetes manifest (JSON) to a cached 'mfst|...' entry and modifies the 'git-refs|...' entry so that Argo CD sees a new commit SHA. With auto-sync (or a manual sync) the poisoned manifest is deployed with Argo CD's cluster privileges, leading to arbitrary workload deployment and potential cluster takeover. Synacktiv's argo-cdown tool automates the Redis stage (list/get/set data and add-manifest); its public release was withheld to give defenders time to apply network policies.

The flaw was demonstrated against Argo CD v2.13.3; earlier versions are likely affected, and a full version list has not been published. Synacktiv reported it in January 2025 and said repeated follow-ups through GitHub and email went unanswered. Publication followed on 2026-07-01 (the page's '01/07/2026' is DD/MM/YYYY; the hunt skeleton's 2026-01-07 date is a misreading). A separate partial fix covers the Helm chart network-policy misconfiguration (GHSA-47m3-95c7-g2g8, referenced by the researchers; the GitHub advisory page could not be retrieved for verification). Secondary reporting (The Hacker News, Cloud Security Alliance, Control Plane) states there is no patched version and no evidence of active exploitation. The defense is network isolation of the repo-server and Redis. The severity is analyst-assigned, and no CVSS score is published.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1552 Unsecured Credentials
- T1565.001 Stored Data Manipulation
- T1610 Deploy Container

## Sources

- [Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL (Synacktiv)](https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql.html)
- [Unpatched Argo CD Repo-Server Flaw (The Hacker News)](https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html)
- [CSA Research Note: Unpatched Argo CD Repo-Server Flaw Threatens AI/ML GitOps Pipelines](https://labs.cloudsecurityalliance.org/research/csa-research-note-argocd-repo-server-rce-gitops-20260704-csa/)
- [Argo CD repo-server RCE (Control Plane)](https://control-plane.io/posts/argo-cd-repo-server-rce/)
- [Argo CD Helm chart network policy misconfiguration advisory GHSA-47m3-95c7-g2g8 (cited by Synacktiv; page not retrievable, date is the citing article's)](https://github.com/advisories/GHSA-47m3-95c7-g2g8)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4851