Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

Argo CD, a tool for deploying software to Kubernetes, has a flaw in its repo-server component that allows unauthenticated attackers to run code if they can access the internal network port. This vulnerability can lead to a full takeover of the Kubernetes cluster. The issue was discovered by Synacktiv, which reported it to Argo CD's maintainers. Currently, there is no available fix for the flaw and it has not been assigned a CVE. The vulnerability is considered significant as it can be exploited without authentication. A fix has not yet been released by the maintainers.