CVE-2026-62185

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

8.6 High

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.46%Up 0.2 points since Jul 14, 2026

What each source reports

CVE List Score used 8.6

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

Record: CVE-2026-62185
CVSS 4.0: 8.6 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-1188
Updated: 2026-11-02

EUVDEUVD-2026-43544 8.6

Record: EUVD-2026-43544
CVSS 4.0: 8.6 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-25jf-qr89-v245 8.6

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod...

Record: GHSA-25jf-qr89-v245
CVSS 4.0: 8.6 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-1188
Updated: 2026-11-02

NVD 8.6

Record: CVE-2026-62185
CVSS 4.0: 8.6 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-1188
Updated: 2026-11-02

OSVCVE-2026-15416 8.9

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

Record: CVE-2026-15416
CVSS 3.1: 8.9 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Weakness: CWE-306
Updated: 2026-11-02

OSV 8.6

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

Record: CVE-2026-62185
CVSS 4.0: 8.6 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-1188
Updated: 2026-11-02

Affected products

argoproj argo-helm

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-62185 is a high vulnerability (CVSS 8.6) in Argoproj Argo-helm, published July 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.

References

Show 10 moreShow less