Auth bypass in Argoproj Argo-Helm
CVE-2026-15416
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.005 (39.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Argoproj Argo-Helm — versions 0
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Gitops
- Red Hat Openshift Gitops 1.19 — versions 1785149260, 1785171339
- Red Hat Self-Service Automation Portal 2
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-15416 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- github.com/argoproj/argo-helm/commit/0f245ab
- github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8
- thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html
- www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rc…
- access.redhat.com/errata/RHSA-2026:52857 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-15416?
- CVE-2026-15416 is a high-severity vulnerability in Argoproj Argo-Helm, classified under Missing Authentication for Critical Function. CVSS score: 8.9/10. Published 2026-07-14.
- How severe is CVE-2026-15416?
- High severity. CVSS v3 base score is 8.9 out of 10.