Unpatched Argo CD repo-server flaw could enable Kubernetes cluster takeovers

Argo CD’s unauthenticated internal repo-server gRPC service allows an attacker who can reach the component’s internal network port to send a crafted request that runs a command. Synacktiv said this could lead to a full cluster takeover. There is currently no fix and no CVE.