9 Service Accounts
11 Workloads
51 Bindings
8 Critical
5 High
3 Medium
35 Low
Image risk: Elevated
Image CVEs: Trivy 0.76.1 + cve.now enrichment, as of 2026-11-06. Default chart images only; a CVE in an image is not proof it is exploitable in this workload. Methodology
Description
A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
argocd-application-controller | default | — | 8 | 1 | Critical | |
argocd-applicationset-controller | default | — | 12 | 1 | Critical | |
argocd-dex-server | default | — | 2 | 1 | Critical | |
argocd-notifications-controller | default | — | 12 | 1 | Critical | |
argocd-server | default | — | 15 | 1 | Critical | |
argo-cd-argocd-redis-secret-init | default | — | 2 | 1 | Low | |
argo-cd-argocd-repo-server | default | — | 0 | 1 | — | |
argo-cd-redis-ha | default | argocd-redis | 0 | 3 | — | |
argo-cd-redis-ha-haproxy | default | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
argocd-server
Namespace: default | Automount:
Permissions (15)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole argo-cd-argocd-server | * | delete · get · patch | Critical | ClusterAdminAccess ClusterWideAccess ClusterWideLogAccess CodeExecution (+10 more) |
Role argo-cd-argocd-server | core/secrets | create · delete · get · list · patch · update · watch | Critical | CredentialAccess DataExposure InformationDisclosure Persistence PotentialPrivilegeEscalation (+2 more) |
ClusterRole argo-cd-argocd-server | //finalizers | update | High | ClusterWideAccess |
Role argo-cd-argocd-server | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole argo-cd-argocd-server | core/pods/log | get | High | ClusterWideLogAccess DataExposure InformationDisclosure LogAccess |
ClusterRole argo-cd-argocd-server | argoproj.io/applications | get · list · update · watch | Low | |
Role argo-cd-argocd-server | argoproj.io/applications | create · delete · get · list · patch · update · watch | Low | |
ClusterRole argo-cd-argocd-server | argoproj.io/applicationsets | get · list · update · watch | Low | |
Role argo-cd-argocd-server | argoproj.io/applicationsets | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-server | argoproj.io/appprojects | create · delete · get · list · patch · update · watch | Low | |
ClusterRole argo-cd-argocd-server | core/events | create · list | Low | |
Role argo-cd-argocd-server | core/events | create · list | Low | |
ClusterRole argo-cd-argocd-server | batch/jobs | create | Low | |
ClusterRole argo-cd-argocd-server | core/pods | get | Low | |
ClusterRole argo-cd-argocd-server | argoproj.io/workflows | create | Low |
Potential Abuse (10)
The following security risks were found based on the above permissions:
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs cluster-wide
- Read pod logs in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Delete namespaces
- Node proxy GET RCE via WebSocket
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-argocd-server | server | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argocd-applicationset-controller
Namespace: default | Automount:
Permissions (12)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role argo-cd-argocd-applicationset-controller | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role argo-cd-argocd-applicationset-controller | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
Role argo-cd-argocd-applicationset-controller | argoproj.io/applications | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-applicationset-controller | argoproj.io/applicationsets | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-applicationset-controller | argoproj.io/applicationsets/finalizers | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-applicationset-controller | argoproj.io/applicationsets/status | get · patch · update | Low | |
Role argo-cd-argocd-applicationset-controller | argoproj.io/appprojects | get · list · watch | Low | |
Role argo-cd-argocd-applicationset-controller | apps/deployments | get · list · watch | Low | |
Role argo-cd-argocd-applicationset-controller | extensions/deployments | get · list · watch | Low | |
Role argo-cd-argocd-applicationset-controller | core/events | create · get · list · patch · watch | Low | |
Role argo-cd-argocd-applicationset-controller | coordination.k8s.io/leases | create | Low | |
Role argo-cd-argocd-applicationset-controller | coordination.k8s.io/leases (restricted to: 58ac56fa.applicationsets.argoproj.io) | create · get · update | Low | ResourceNameRestricted |
Potential Abuse (4)
The following security risks were found based on the above permissions:
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-argocd-applicationset-controller | applicationset-controller | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argocd-notifications-controller
Namespace: default | Automount:
Permissions (12)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole argo-cd-argocd-notifications-controller | core/secrets | list · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role argo-cd-argocd-notifications-controller | core/secrets | list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole argo-cd-argocd-notifications-controller | core/configmaps | list · watch | High | ConfigMapAccess DataExposure InformationDisclosure |
Role argo-cd-argocd-notifications-controller | core/configmaps | list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
ClusterRole argo-cd-argocd-notifications-controller | argoproj.io/applications | get · list · patch · update · watch | Low | |
Role argo-cd-argocd-notifications-controller | argoproj.io/applications | get · list · patch · update · watch | Low | |
ClusterRole argo-cd-argocd-notifications-controller | argoproj.io/appprojects | get · list · patch · update · watch | Low | |
Role argo-cd-argocd-notifications-controller | argoproj.io/appprojects | get · list · patch · update · watch | Low | |
ClusterRole argo-cd-argocd-notifications-controller | core/configmaps (restricted to: argocd-notifications-cm) | get | Low | ResourceNameRestricted |
Role argo-cd-argocd-notifications-controller | core/configmaps (restricted to: argocd-notifications-cm) | get | Low | ResourceNameRestricted |
ClusterRole argo-cd-argocd-notifications-controller | core/secrets (restricted to: argocd-notifications-secret) | get | Low | ResourceNameRestricted |
Role argo-cd-argocd-notifications-controller | core/secrets (restricted to: argocd-notifications-secret) | get | Low | ResourceNameRestricted |
Potential Abuse (5)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-argocd-notifications-controller | notifications-controller | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argocd-application-controller
Namespace: default | Automount:
Permissions (8)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole argo-cd-argocd-application-controller | * | * | Critical | APIServerDoS APIServiceManipulation AvailabilityImpact BackupAccess (+68 more) |
Role argo-cd-argocd-application-controller | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role argo-cd-argocd-application-controller | core/configmaps | get · list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
Role argo-cd-argocd-application-controller | argoproj.io/applications | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-application-controller | argoproj.io/applicationsets | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-application-controller | argoproj.io/appprojects | create · delete · get · list · patch · update · watch | Low | |
Role argo-cd-argocd-application-controller | apps/deployments | get · list · watch | Low | |
Role argo-cd-argocd-application-controller | core/events | create · list | Low |
Potential Abuse (107)
The following security risks were found based on the above permissions:
- Cluster-wide pod exec
- Namespaced pod exec
- Cluster-wide pod attach
- Namespaced pod attach
- Cluster-wide pod port-forward
- Namespaced pod port-forward
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Node proxy access (Kubelet API)
- Modify node configuration (labels, taints)
- Delete nodes
- Manage PersistentVolumes (cluster-wide storage manipulation)
- Read pod logs cluster-wide
- Read pod logs in a namespace
- Manage ephemeral containers cluster-wide
- Manage ephemeral containers in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Delete namespaces
- Manage ClusterRoles (create, update, patch, delete)
- Manage ClusterRoleBindings (create, update, patch, delete)
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Escalate privileges via ClusterRoles (escalate verb)
- Bind ClusterRoles to identities (bind verb)
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets cluster-wide (runs on all nodes, high impact)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets cluster-wide
- Manage StatefulSets in a namespace
- Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs cluster-wide (one-off privileged execution)
- Manage Jobs in a namespace (one-off privileged execution)
- Manage MutatingWebhookConfigurations
- Manage ValidatingWebhookConfigurations
- Manage CustomResourceDefinitions
- Manage APIServices
- Create ServiceAccount Tokens
- Create ServiceAccount Tokens (ClusterRole for any SA in any namespace)
- Create TokenReviews (validate arbitrary tokens)
- Create SubjectAccessReviews (check arbitrary permissions)
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Approve CertificateSigningRequests
- Create CertificateSigningRequests
- Manage (get, list, watch, delete) CertificateSigningRequests
- Manage CSIDrivers (potential node compromise)
- Manage StorageClasses
- Evict Pods cluster-wide
- Evict Pods in a namespace
- Manage RuntimeClasses
- Wildcard permission on all resources cluster-wide (Cluster Admin)
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ClusterIssuers (cert-manager.io)
- Manage ArgoCD Applications (argoproj.io)
- Manage Cilium ClusterwideNetworkPolicies (cilium.io)
- Manage ETCDSnapshotFiles (k3s.cattle.io)
- Impersonate users, groups, or service accounts (cluster-wide)
- Manage ServiceAccounts cluster-wide
- Manage ServiceAccounts in a namespace
- Patch node status cluster-wide
- Read events cluster-wide
- Manage NetworkPolicies cluster-wide
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- Read RBAC configuration cluster-wide
- Use privileged PodSecurityPolicy (deprecated)
- Manage PodDisruptionBudgets cluster-wide
- Manage Leases cluster-wide
- Manage Leases in kube-system or kube-node-lease namespace
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Read All ResourceQuotas (Cluster-wide Information Disclosure)
- Update CertificateSigningRequest Status (Tampering/DoS)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Manage IngressClasses (Cluster-wide Traffic Control Tampering)
- Update NetworkPolicy Status (Cluster-wide Tampering)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Read ComponentStatuses (Control Plane Reconnaissance)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Manage FlowSchemas (API Server DoS/Manipulation)
- Manage PriorityLevelConfigurations (API Server DoS/Manipulation)
- Read CSINode Objects (Node & Storage Reconnaissance)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Manage VolumeAttachments (Cluster-wide Storage/Node Manipulation)
- Watch All Resources in a Namespace (Broad Information Disclosure)
- Node proxy GET RCE via WebSocket
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | argo-cd-argocd-application-controller | application-controller | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argocd-dex-server
Namespace: default | Automount:
Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role argo-cd-argocd-dex-server | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role argo-cd-argocd-dex-server | core/configmaps | get · list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
Potential Abuse (3)
The following security risks were found based on the above permissions:
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-argocd-dex-server | dex-server | ghcr.io/dexidp/dex:v2.46.1 Moderate
0 critical · 20 high Top 8 of 41 CVEs
|
argo-cd-argocd-redis-secret-init
Namespace: default | Automount:
Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role argo-cd-argocd-redis-secret-init | core/secrets | create | Low | |
Role argo-cd-argocd-redis-secret-init | core/secrets (restricted to: argocd-redis) | get | Low | ResourceNameRestricted |
Potential Abuse (1)
The following security risks were found based on the above permissions:
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | argo-cd-argocd-redis-secret-init | secret-init | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argo-cd-argocd-repo-server
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-argocd-repo-server | repo-server | quay.io/argoproj/argocd:v3.6.1 Moderate
0 critical · 15 high Top 8 of 69 CVEs
|
argo-cd-redis-ha
Namespace: default | Automount: | Secrets: argocd-redis
Permissions (0)
No explicit RBAC bindings.
Workloads (3)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | argo-cd-redis-ha-server | redis | ecr-public.aws.com/docker/library/redis:8.6.4-alpine Moderate
0 critical · 8 high Top 8 of 18 CVEs
|
| StatefulSet | argo-cd-redis-ha-server | sentinel | ecr-public.aws.com/docker/library/redis:8.6.4-alpine Moderate
0 critical · 8 high Top 8 of 18 CVEs
|
| StatefulSet | argo-cd-redis-ha-server | split-brain-fix | ecr-public.aws.com/docker/library/redis:8.6.4-alpine Moderate
0 critical · 8 high Top 8 of 18 CVEs
|
argo-cd-redis-ha-haproxy
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-cd-redis-ha-haproxy | haproxy | ecr-public.aws.com/docker/library/haproxy:3.3.10-alpine Elevated
1 critical · 6 high Top 8 of 21 CVEs
|