Auth bypass in Argoproj Argo-Helm
CVE-2026-15416
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Vulnerability class: Broken Authentication
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.
Affected products
- Argoproj Argo-helm — versions 0
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Gitops
- Red Hat Openshift Gitops 1.19 — versions 1785149260, 1785171339
- Red Hat Self-service Automation Portal 2
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com
- secalert@redhat.com
- secalert@redhat.com
- secalert@redhat.com
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2026-15416?
- CVE-2026-15416 is a high-severity vulnerability in Argoproj Argo-Helm, classified under Missing Authentication for Critical Function. CVSS score: 8.9/10. Published 2026-07-14.
- How severe is CVE-2026-15416?
- High severity. CVSS v3 base score is 8.9 out of 10.