Nixpkgs security tracker
Dismissed
(no matching packages found)
Permalink
CVE-2026-15416
8.9 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Adjacent (A)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Adjacent (A)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): Low (L)
Activity log
- Created & dismissed (no matching packages found) suggestion
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
References
Affected products
argo-helm
- <10.0.0
openshift-gitops-1/argocd-rhel8
openshift-gitops-1/argocd-rhel9
openshift-gitops-1/gitops-rhel8
openshift-gitops-1/gitops-rhel9
odf4/odf-multicluster-rhel9-operator
openshift-gitops-1/argocd-agent-rhel8
openshift-gitops-1/argocd-agent-rhel9
openshift-gitops-1/gitops-rhel8-operator
openshift-gitops-1/gitops-rhel9-operator
openshift-gitops-1/gitops-operator-bundle
openshift-gitops-1/argocd-image-updater-rhel8
openshift-gitops-1/argocd-image-updater-rhel9