Unauthenticated RCE in ArgoCD

What it is

A Synacktiv writeup of an unauthenticated arbitrary code execution vulnerability in Argo CD's repo-server component, found using CodeQL against Argo CD's ~238,000-line Go codebase. No CVE, affected version, or patch appears in the available text — the page is truncated at the start of the technical walkthrough, before the injection itself is disclosed.

How it works

The repo-server is the component that fetches from Git repositories (manifests, Helm charts, config) and generates Kubernetes manifests to deploy. It is the injection point. The discovery method is the substance here: rather than run CodeQL's default security queries (which Argo CD's own team already runs in CI, so they yield nothing new), the author maps the attack surface first using the githubsecuritylab/audit/attack-surface query to enumerate every RemoteFlowSource — any externally controllable data — then applies data-flow analysis to trace those sources into an injection sink.

import semmle.go.security.FlowSources
from RemoteFlowSource::Range source
where not source.getFile().getRelativePath().matches("%/test/%")
select source, "remote", source.getFile().getRelativePath(), source.getStartLine(),
  source.getEndLine(), source.getStartColumn(), source.getEndColumn()

Preconditions / Affected

Why compromise here is total: to deploy into clusters, Argo CD holds significant in-cluster privileges plus credentials for private Git repos. A notable secondary exposure the page calls out explicitly — Argo CD caches plugin-generated manifests and injected secrets in its Redis instance, and those manifests are also served via the repo-server's gRPC API. So the secrets are reachable by anyone with access to Redis or to the repo-server, independent of the RCE.

What to do

The available text gives no version, patch, or mitigation — those would follow in the truncated remainder. Two things are usable now:

• Treat any exposure of the repo-server gRPC service or the Redis cache as a secret-disclosure path, not merely a caching detail.
• The attack-surface-first CodeQL workflow above is directly reusable for auditing other large Go services: enumerate RemoteFlowSources, then run data-flow to sinks, instead of relying on default queries the target may already run in CI.

Caveats

The fetched page is cut off before the vulnerability, the full exploitation chain, and the announced automation tool are described. To act on the Argo CD flaw specifically (identify affected versions and patch), consult the original article — the actionable disclosure is not in the retrieved text.