Synacktiv researchers have disclosed an unpatched vulnerability in Argo CD, the widely-used GitOps deployment tool, that allows unauthenticated remote code execution and full takeover of Kubernetes clusters. Reported to maintainers in January 2025, the flaw remains unpatched over a year later. The vulnerability resides in Argo CD's repo-server component, whose gRPC interface lacks authentication. An attacker with internal cluster access — achievable via a compromised pod — can inject malicious KustomizeOptions to execute arbitrary code, access the Redis database, and deploy arbitrary Kubernetes manifests. Synacktiv recommends applying strict Kubernetes network policies as a mitigation until a fix is released, and is temporarily withholding their exploitation tool to give defenders time to act.
