FR
live
High CVSS 8.9

CVE-2026-15416

NVD analysis in progress

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

What this means

Exposure
Exploitable from the adjacent network, with an ordinary user account and with no action from the victim.
Impact
An attacker can read sensitive data, modify or destroy data and degrade the service. The impact spreads beyond the vulnerable component into other parts of the system.
Weakness
A sensitive function is reachable with no authentication at all.
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
14 July 2026
CVSS
8.9 (v3.1) CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS
0.28% probability of exploitation within 30 days · above 20% of all CVEs
Weakness
CWE-306
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss