Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Argo CD may create forbidden resources when deleting apps

CVE-2026-77459 · published 2 days ago
Summary

Versions of Argo CD from 2.10.0 up to 3.3.15, 3.4.10, 3.5.4 and 3.6.0‑rc2 can run a delete‑hook that bypasses the normal project rules, allowing creation of resources in disallowed namespaces or clusters. If someone can modify the Git repo for an application, they could cause the controller to create unwanted resources when the application is deleted. Updating to the fixed releases removes this risk.

What to do
  • Update github.com argoproj to version 3.3.15.
  • Update github.com argoproj to version 3.4.10.
  • Update github.com argoproj to version 3.5.4.
  • Update github.com argoproj to version 3.6.0-rc2.
Affected software
Ecosystem VendorProductAffected versions
– argoproj argo-cd >= 2.10.0, <= 2.14.21
go github.com argoproj >= 2.10.0, <= 2.14.21
go github.com argoproj >= 3.0.0, < 3.3.15
>= 3.4.0, < 3.4.10
>= 3.5.0, < 3.5.4
>= 3.6.0-rc1, < 3.6.0-rc2
Fix: upgrade to 3.3.15
Original advisory text
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published13 Oct 2026
Updated16 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-77459 · NVD
CVE-2026-77459 · MITRE
CVE-2026-77459 · OSV
GHSA-fmxq-cgp8-87wp · GHSA
Track software like this
Free during beta