Tag
Argo CD: Arbitrary code execution via Helm downloader plugin (CVE-2026-113709)
2 TTPs 1 CVEArgo CD versions 2.1.0 through 3.6.0-rc1 are vulnerable to arbitrary code execution if --enable-helm is used, allowing attackers to inject a malicious Helm plugin via repository-controlled configuration.
Argo CD AppProject Restriction Bypass via Delete Hooks
1 TTP 1 CVEArgo CD fails to validate AppProject destination and resource restrictions during PreDelete and PostDelete hook execution, allowing attackers to escalate privileges via the application-controller.
OpenShift GitOps Operator Vulnerability Allows Denial of Service via ClusterRole Name Collision
1 TTP 1 CVEA high-severity denial of service vulnerability, identified as CVE-2026-14251, exists in the OpenShift GitOps operator where a namespace-scoped Argo CD instance can trigger the deletion of a cluster-scoped Argo CD instance's ClusterRole by exploiting a name collision due to improper resource ownership validation.
Unauthenticated Remote Code Execution in Argo CD Repo-Server (CVE-2026-15416)
3 TTPs 1 CVEAn unauthenticated remote code execution vulnerability (CVE-2026-15416) exists in Argo CD's repo-server, the GitOps engine used by Red Hat OpenShift GitOps, allowing an attacker with network access to achieve RCE and deploy malicious Kubernetes resources, leading to potential cluster compromise.
Red Hat OpenShift GitOps Multiple Vulnerabilities
2 rules 1 TTPAn anonymous remote attacker can exploit multiple vulnerabilities in Red Hat OpenShift GitOps to manipulate data, misrepresent information, or cause a denial of service.