CVE-2026-77459 · GHSA-fmxq-cgp8-87wp

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Risk score: 75/100
CVSS: 9.9 v3.1
Exploit chance (30 days): 0.7%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include clus…
Affected: github.com/argoproj/argo-cd/v2 (go) >= 2.10.0, <= 2.14.21; github.com/argoproj/argo-cd/v3 (go) >= 3.0.0, < 3.3.15; github.com/argoproj/argo-cd/v3 (go) >= 3.4.0, < 3.4.10; github.com/argoproj/argo-cd/v3 (go) >= 3.5.0, < 3.5.4
Fix: Upgrade github.com/argoproj/argo-cd/v3 to 3.3.15 or 3.4.10 or 3.5.4 or 3.6.0-rc2 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/argoproj/argo-cd/v2: Amber, patch this week. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include clus…

The flaws

CVE-2026-77459: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (CVSS 9.9 · EPSS 1%)
CVE-2026-55797: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8 · EPSS 2%)

The fix

Upgrade github.com/argoproj/argo-cd/v2: 3.3.15 · 3.4.10 · 3.5.4 · 3.6.0 or later on your release line

Who is exposed: github.com/argoproj/argo-cd/v2 (go) >= 2.10.0, <= 2.14.21; github.com/argoproj/argo-cd/v3 (go) >= 3.0.0, < 3.3.15; github.com/argoproj/argo-cd/v3 (go) >= 3.4.0, < 3.4.10; github.com/argoproj/argo-cd/v3 (go) >= 3.5.0, < 3.5.4

Where it stands

No known exploitation

Connects to

Same weakness: Incorrect authorisation (CWE-863). 336 other warnings in 30 days

Why it is Amber

CVSS 9.9 critical
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/argoproj/argo-cd/v2	go	>= 2.10.0, <= 2.14.21	No fix yet
github.com/argoproj/argo-cd/v3	go	>= 3.0.0, < 3.3.15	3.3.15
github.com/argoproj/argo-cd/v3	go	>= 3.4.0, < 3.4.10	3.4.10
github.com/argoproj/argo-cd/v3	go	>= 3.5.0, < 3.5.4	3.5.4
github.com/argoproj/argo-cd/v3	go	>= 3.6.0-rc1, < 3.6.0-rc2	3.6.0-rc2

References

Original description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Last activity 13 Oct 2026. Patch Forecast updates every hour.