Skip to content
Heist/ feed
Critical

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Type: advisorySource: Official CVE List1 source record

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Announced Source revision 1
Original source ↗

CVE-2026-77459

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-77459

argo-cd

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "argoproj",
    "product": "argo-cd",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.10.0, <= 2.14.21"
      },
      {
        "status": "affected",
        "version": ">= 3.0.0, < 3.3.15"
      },
      {
        "status": "affected",
        "version": ">= 3.4.0, < 3.4.10"
      },
      {
        "status": "affected",
        "version": ">= 3.5.0, < 3.5.4"
      },
      {
        "status": "affected",
        "version": ">= 3.6.0-rc1, < 3.6.0-rc2"
      }
    ]
  }
]
Related CVEs
CVE-2026-77459

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#22103 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement