Unpatched Vulnerability in Argo CD Poses Risks to Kubernetes Deployments
Argo CD has become a prominent tool for developers leveraging GitOps to deploy cloud-native applications on Kubernetes. Its growing adoption, however, has made it a target for cybercriminals. Researchers from Synacktiv, a French cybersecurity firm, identified an unaddressed vulnerability within Argo CD that could enable attackers to execute code remotely and seize control of Kubernetes environments.
Discovered over a year ago, this flaw has yet to receive a patch from Argo CD maintainers, despite Synacktiv reaching out in January 2025. Hugo Vincent, a security expert at Synacktiv, emphasized the severity of the oversight, stating that failure to address this could allow malicious entities to take complete control of a Kubernetes cluster. "We felt it necessary to go public with this information to help users safeguard their systems,” he wrote.
Widespread Use of Argo CD
The potential for this vulnerability to be exploited is alarming given Argo CD’s popularity. A recent survey commissioned by the Argo Project, overseen by the Cloud Native Computing Foundation, revealed that an impressive 93% of respondents utilize Argo CD in their production setups. Moreover, in a 2023 survey by Octopus Deploy, approximately 50% of those employing GitOps methodologies reported using Argo CD, with its nearest competitor, Flux, lagging at 11%.
Vincent highlighted that Argo CD simplifies application deployments significantly. Its design is rooted in GitOps, which promotes using Git repositories as definitive sources for infrastructure management. The adoption of infrastructure-as-code (IaC) allows these applications to maintain proper infrastructure configurations automatically, streamlining Kubernetes management.
Why It’s a Prime Target
One reason underlying the tool’s vulnerability is its high privilege requirements within Kubernetes clusters. "To effectively deploy resources, Argo CD must operate with elevated permissions," Vincent noted. "Moreover, its access to private Git repositories heightens its appeal for attackers."
The flaw specifically impacts the repo-server component of Argo CD, which acts as an intermediary between developers' version control systems and Kubernetes clusters. This component is responsible for cloning Git repositories and processing deployment configurations using tools like Helm and Kustomize.
During the process of manifest generation, users send API calls to the server, which can forward sensitive parameters if improperly configured. Vincent explained that a lack of authentication in the gRPC service of the repo-server creates an entry point for unauthorized code execution. Attackers capable of targeting it can, therefore, inject their own KustomizeOptions, leading to potentially malicious deployments.
Exploitation Pathway
The exploitation method appears relatively easy to execute. A malicious actor would need to initiate a gRPC call containing the required parameters. While achieving arbitrary code execution demands additional steps—such as accessing build options within KustomizeOptions that could lead to code execution—this does not represent an insurmountable barrier for skilled attackers.
Vincent and his team explored ways to leverage this vulnerability effectively. They discovered that incorporating a "dummy application" into the cluster was necessary. This approach enabled them to use the internal access within the cluster that Argo CD's network policies should ideally restrict. However, the standard Helm chart for Argo CD lacks the default network policies that would ordinarily limit access, creating an exploitable gap for intruders.
Compromised Database Access
The researchers successfully exploited the vulnerability to extract the Redis password from the repo-server, leading to unauthorized access to the Argo CD Redis database. Vincent described their methodology, which involved modifying manifest entries within the cluster. "With our tool, we can execute the entire process. By adding a new manifest and altering the connected git-ref entry, the harmful manifest is deployed shortly thereafter,” he explained.
With this dominance over cluster deployments, attackers could significantly compromise the integrity and security of Kubernetes environments. To mitigate risks until a formal patch is developed, Vincent suggests applying stringent network policies as a temporary safeguard.
As a proactive measure, Synacktiv plans to delay the release of their exploitation tool, "argo-cdown," allowing administrators time to implement necessary defenses. Vincent stated, "We will eventually make this tool available, enabling administrators to confirm if their systems are vulnerable.”
