threat-intel
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
Critical
Summary
An unpatched vulnerability in Argo CD's repo-server component allows unauthenticated attackers to take over Kubernetes clusters by exploiting a lack of authentication and network policies. Synacktiv discovered the flaw in version 2.13.3 and warned Argo CD maintainers in January 2025, but a fix was not released for 18 months. Attackers can leverage this to read sensitive information like Redis passwords and deploy malicious workloads.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data