VDB
CVE-2026-15416
CVE-2026-15416
PUBLISHED
CVSS 8.9 HIGH
Reported by redhat · Published July 14, 2026
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
Risk Scores
CVSS 3.1
8.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| argoproj | argo-helm | 0 |
| Red Hat | Red Hat OpenShift GitOps 1.19 | 1785149260 |
| Red Hat | Red Hat OpenShift GitOps 1.19 | 1785171339 |
| Red Hat | Red Hat Openshift Data Foundation 4 | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps | |
| Red Hat | Red Hat OpenShift GitOps 1.19 | 1785171339 |
| Red Hat | Red Hat OpenShift GitOps |
…and 8 more
Timeline
- Jul 14, 2026 EPSS Score
- Jul 14, 2026 CVE Published
- Jul 15, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
- Aug 11, 2026 CVE Updated
- Aug 12, 2026 Distribution Patch
- Aug 12, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
References
- RHSA-2026:52857 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2496732 issue-trackingx_refsource_REDHAT