Serious Security Vulnerability in Argo CD Poses Risk to Kubernetes Deployments

Argo CD is gaining traction among developers utilizing GitOps for deploying cloud-native applications to Kubernetes. However, this popularity may draw the ire of cybercriminals, especially given the latest security findings.

Researchers at the French cybersecurity firm Synacktiv have reported an unaddressed vulnerability that could enable malicious actors to execute code remotely, allowing them to seize control of Kubernetes deployments. Discovered over a year ago and reported to Argo CD maintainers in January 2025, the flaw remains unpatched despite numerous attempts to resolve it, according to Hugo Vincent, a security expert at Synacktiv.

In a report aiming to inform the community of the risk, Vincent stated, “We have decided to publish this post to alert the community to the risk so that users can protect their environments.”

Argo CD’s Epidemiological Popularity

The repercussions of this vulnerability could extend throughout the robust Argo CD user base. A 2023 survey from the Argo Project, overseen by the Cloud Native Computing Foundation, revealed that a staggering 93% of respondents implement the tool in production environments. A follow-up survey conducted by Octopus Deploy found that among organizations embracing GitOps, about 50% rely on Argo CD, leaving the next closest competitor, Flux, far behind at just 11%.

Vincent emphasized the utility of Argo CD, noting that developers benefit from streamlined application deployments through its integration with GitOps, which utilizes Git repositories as the single source of truth. This methodology, empowered by Infrastructure as Code (IaC), allows for automated application of infrastructure configurations, affording users an efficient means of managing Kubernetes clusters.

Attractive Lure for Threat Actors

Vincent commented on the significant privileges Argo CD requires within Kubernetes clusters, highlighting that its access to private Git repositories makes it a prime target for attacks. “To function effectively and deploy resources in Kubernetes clusters, Argo CD requires significant privileges within the cluster,” he stated.

The security issue is rooted in the repo-server component of Argo CD, which serves as an intermediary, cloning Git repositories and interacting with Kubernetes clusters. Vincent explained that an administrative definition of the KustomizeOptions struct could trigger exposure to a vulnerability. The repo-server's gRPC server lacks authentication measures, enabling a remote code execution (RCE) scenario if an attacker gains access.

Steps Required for Exploitation

Exploitation of this flaw is relatively simple. An attacker must initiate a gRPC call with the necessary parameters. However, achieving arbitrary code execution involves additional steps, particularly utilizing the BuildOptions from KustomizeOptions. Given that the kustomize binary contains parameters for arbitrary execution, it potentially amplifies the risk.

The Synacktiv team discovered that introducing a “dummy application” into the cluster provided necessary internal access for exploiting the vulnerability. Although Argo CD does enforce network policies to isolate the repo-server, the Helm chart used for installation doesn’t incorporate these policies by default. Consequently, an adversary that compromises a pod—such as the dummy application—could leverage this internal access to exploit the vulnerability.

Gaining Access to the Redis Database

Utilizing the vulnerability, the researchers succeeded in extracting the Redis password from the repo-server, which granted access to the Argo CD Redis database. “With our tool, we can execute the entire scenario,” Vincent detailed. “The first step is to add the new manifest to the mfst entry [and then] modify or add the associated git-ref entry.” Once deployed, the malicious manifest allows attackers to assume control of the cluster.

Vincent suggests that the implementation of strict network policies could mitigate the risk until an official fix is made available. To support defenders in preemptively securing their environments, Synacktiv is postponing the release of its exploitation tool, dubbed argo-cdown. This tool will be uploaded to GitHub for administrators to verify their deployments against vulnerabilities effectively.