Argo CD Helm chart: no network policies by default, so any pod on the cluster can reach repo-server

Impact

Installs from the Argo CD Helm chart before 10.0.0 ship without NetworkPolicies, so every pod in the cluster can open connections to repo-server and the other Argo CD APIs. repo-server renders manifests and holds repository credentials, and the advisory describes chaining that unrestricted reach into cluster compromise and remote code execution. On a multi-tenant GPU cluster this collapses the separation between a tenant's training or inference pod and the controller that decides what gets deployed to every node: a tenant who gets code execution in any pod - including through a model or notebook they submitted - can attack the deployment path for the whole fleet. Nothing about the attack requires Argo CD credentials; it requires only being a pod on the same cluster network.

Who can reach it

Any workload running as a pod on the cluster, including an untrusted tenant pod, reaching the Argo CD service network. No Argo CD authentication needed to reach the exposed APIs.

What to do

Upgrade the Argo CD Helm chart to 10.0.0 or later, which installs the network policies, or add equivalent NetworkPolicies yourself restricting ingress to argocd-repo-server and the Argo CD APIs to the argocd namespace. Either way this is a redeploy of the Argo CD release and a restart of its pods - no GPU node drain, no reboot. Requires a CNI that enforces NetworkPolicy; on clusters where it is not enforced, segment at the service-mesh or firewall layer instead.

References

Related entries

• OSAC operator: unsanitized kubeconfig Secret runs an exec credential plugin as the console-proxy podCVE-2026-62284 · OSAC operator (console-proxy RemoteConfigResolver kubeconfig handling)High
• Harbor (harbor-helm, default core.secretName JWT signing key): SUPPLY CHAIN, UNAUTHENTICATED REGISTRY ACCESS: HarborNCVD-2023-011-harbor-harbor-helm-default-core · Harbor (harbor-helm, default core.secretName JWT signing key)High
• Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart authorCVE-2020-11013 · HelmHigh
• runc: Container filesystem breakout via directory traversal in mount handlingCVE-2021-30465 · runcHigh
• Argo CD: Authorization bypass lets an Application be synced to a destination it is not permitted to reachCVE-2023-22736 · Argo CDHigh
• KubeVirt CDI: PVCs can be cloned from unauthorized namespaces via DataImportCronCVE-2025-14459 · KubeVirt CDIHigh