Is CVE-2026-15416 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15416 being exploited in the wild.

How severe is CVE-2026-15416?

High severity, with a CVSS score of 8.9, published 14 July 2026.

Which products and versions are affected?

Argo Project Argo CD Helm Chart < 10.0.0.

Is there a fix for CVE-2026-15416?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15416 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-15416?

Check whether you run Argo Project Argo CD Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15416: Argo CD remote code execution in repo-server via GenerateManifest

Q: Is there a fix for CVE-2026-15416?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15416 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-15416?

Check whether you run Argo Project Argo CD Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15416 · Severity: high · CVSS 8.9 · Published 2026-07-14

Argo CD is a tool used to automate the deployment of applications into Kubernetes clusters. A security flaw in its repository server component allows an attacker who has gained a foothold in the same network to execute unauthorized commands. This could allow an attacker to deploy malicious software across the entire cluster, potentially leading to a total takeover of the organization's container infrastructure and data.

Vendors: Argo Project.

Quick answers

Is CVE-2026-15416 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15416 being exploited in the wild.
How severe is CVE-2026-15416?: High severity, with a CVSS score of 8.9, published 14 July 2026.
Which products and versions are affected?: Argo Project Argo CD Helm Chart < 10.0.0.
Is there a fix for CVE-2026-15416?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15416 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-15416?: Check whether you run Argo Project Argo CD Helm Chart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Argo CD repo-server's GenerateManifest gRPC endpoint due to missing authentication (CWE-306). An attacker with network access to the repo-server can provide malicious KustomizeOptions, specifically manipulating BuildOptions or BinaryPath, to achieve remote code execution within the repo-server pod. This is particularly exploitable when Argo CD is installed via Helm charts where network policies are disabled by default (versions < 10.0.0), allowing any pod in the cluster to reach the gRPC service. By combining this RCE with Redis cache manipulation, an attacker can deploy unauthorized Kubernetes resources, leading to full cluster compromise. The issue is addressed in Argo CD Helm Chart version 10.0.0 by enabling network policies by default.

Affected products

argoproj Argo CD Helm Chart < 10.0.0
Red Hat Red Hat OpenShift GitOps 1
Red Hat Red Hat OpenShift Data Foundation 4 4

Timeline

2025-01: disclosed: Vulnerability reported to maintainers by Synacktiv
2026-06-29: advisory: GitHub Security Advisory published for argo-helm
2026-07-14: advisory: CVE-2026-15416 published by Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.