PT-2026-57989 · Red Hat+1 · Openshift Data Foundation+2

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-15416

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenShift Data Foundation 4 odf-multicluster-rhel9-operator (affected versions not specified) OpenShift GitOps argocd-image-updater-rhel8 (affected versions not specified) OpenShift GitOps argocd-rhel8 (affected versions not specified) OpenShift GitOps gitops-operator-bundle (affected versions not specified) OpenShift GitOps gitops-rhel8 (affected versions not specified) OpenShift GitOps gitops-rhel8-operator (affected versions not specified)

Description A flaw in the Argo CD repo-server allows an unauthenticated attacker with network access to the internal gRPC endpoint to achieve remote code execution. If the attacker can also access the Redis cache, they may manipulate cached deployment data to deploy malicious Kubernetes resources to managed clusters, which could lead to a complete cluster compromise.

Recommendations Lock down the repo-server and Redis services using NetworkPolicies to ensure they are not exposed externally or to untrusted pods. Apply vendor fixes for odf-multicluster-rhel9-operator, argocd-image-updater-rhel8, argocd-rhel8, gitops-operator-bundle, gitops-rhel8, and gitops-rhel8-operator as they become available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-15416

Affected Products

Argo Cd

Openshift Data Foundation

Openshift Gitops

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-15416 · Security Note
• https://github.com/argoproj/argo-helm/security/advisories/GHSA-47m3-95c7-g2g8 · Note
• https://github.com/argoproj/argo-helm/commit/0f245ab · Note
• https://reddit.com/r/linuxadmin/comments/1uw44s6/cve202615416_argo_cd_reposerver_flaw_could_lead · Reddit Post
• https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html · Note
• https://synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2496732 · Note
• https://access.redhat.com/security/cve/CVE-2026-15416 · Note
• https://twitter.com/CVEnew/status/2076980583381565523 · Twitter Post
• https://reddit.com/r/redhat/comments/1uw453l/cve202615416_argo_cd_reposerver_flaw_could_lead · Reddit Post