Unauthenticated RCE in Argo CD lets attackers hijack whole Kubernetes clusters
Synacktiv uncovers an unauthenticated RCE chain in Argo CD's repo‑server: attackers can reach the gRPC endpoint, abuse Kustomize options to execute commands, then pivot through Redis to harvest credentials and seize the entire cluster. The flaw highlights the danger of exposing powerful tooling without strict access controls in GitOps pipelines.