Argo CD Repo-Server Spawning Unexpected Shell Child Processes

Ethan Andrews@eandrews

•updated Jul 1, 2026•3•0•10

Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.