Executive brief
Argo CD is a popular tool used to automate the deployment of applications to Kubernetes clusters. A security issue in its Helm Chart installation package means that, by default, it does not restrict network traffic between different parts of the cluster. This could allow a malicious or compromised application running in the same environment to access sensitive Argo CD internal services, potentially leading to full cluster takeover and unauthorized code execution.
Technical details
The Argo CD Helm Chart (argo-helm) prior to version 10.0.0 suffers from an insecure default configuration where Kubernetes NetworkPolicies are not created by default. This lack of isolation allows any pod within the cluster to communicate with sensitive internal components such as the repo-server and other Argo APIs. An attacker with low-privileged access to any pod in the adjacent network (the cluster) can leverage this unrestricted access to perform lateral movement. When combined with other attack vectors, this can result in remote code execution (RCE) and full cluster compromise. The issue is resolved in version 10.0.0 by setting 'global.networkPolicy.create' to true by default.
Affected products
- argoproj argo-helm < 10.0.0
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published by maintainers
- 2026-07-13: disclosed: NVD publication date