Skip to main content

Argo CD

Browse all articles, tutorials, and guides about Argo CD

2posts

Posts

Security
|11 min read

Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE

An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.

Kubernetes
|10 min read

Argo CD CVE-2026-42880: When Read-Only Means Read-Everything-Including-Secrets

A critical Argo CD bug (CVSS 9.6, disclosed May 7) lets any authenticated user pull plaintext Kubernetes Secrets out of any Application that has ServerSideDiff with mutation-webhook diffs enabled. Here is the upgrade matrix, the one-liner to find at-risk apps in your cluster, and the safe RBAC scope-down for teams that cannot patch today.