TLDR Tech / InfoSec
Unauthenticated Remote Code Execution in Argo CD via CodeQL
Synacktiv details how unauthenticated attackers can exploit Argo CD's repo-server gRPC endpoint using crafted Kustomize options to execute commands via the kustomize binary. This allows pivoting to Redis to steal credentials, push malicious manifests, and ultimately gain control of the Kubernetes cluster. Mitigations include securing repo-server and Redis network access and ensuring Argo CD network policies are enforced, even when deploying via Helm.
Read the full story