CVE-2026-15416
High
Description
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
SeverityHigh
CVSS8.9
Exploit probability—
Product
Argoproj Argo-helm
PublishedJul 14, 2026
First seenJul 14, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- argoproj argo-helm10.0.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo-helm | v < 10.0.0 | 10.0.0 |
| openshift_gitops 1.19 | No range specified | — |
| Red Hat Red Hat OpenShift GitOps | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.