Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Summary
| CVE | CVE-2026-77459 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 17:17:46 UTC |
| Updated | 2026-10-16 16:00:33 UTC |
| Description | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. |
Risk And Classification
Primary CVSS: v3.1 9.9 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.007200000 probability, percentile 0.528650000 (date 2026-10-14)
Problem Types: CWE-863 | CWE-863 CWE-863: Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Argoproj | Argo-cd | affected >= 2.10.0, <= 2.14.21 | Not specified |
| CNA | Argoproj | Argo-cd | affected >= 3.0.0, < 3.3.15 | Not specified |
| CNA | Argoproj | Argo-cd | affected >= 3.4.0, < 3.4.10 | Not specified |
| CNA | Argoproj | Argo-cd | affected >= 3.5.0, < 3.5.4 | Not specified |
| CNA | Argoproj | Argo-cd | affected >= 3.6.0-rc1, < 3.6.0-rc2 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/argoproj/argo-cd/commit/4bc8085b0a6d2296b849539d3d09fc7be7a4a511 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/commit/1149cdc6e932208c4402183cc3d7b7485239940c | [email protected] | github.com | |
| github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp | [email protected] | github.com | |
| github.com/argoproj/argo-cd/releases/tag/v3.4.10 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/releases/tag/v3.5.4 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/commit/7f0a05834b05103d69d7c150e1ee36541b314696 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/commit/d5dd7019ee65be8895133fe4df554e28074242c4 | [email protected] | github.com | |
| github.com/argoproj/argo-cd/releases/tag/v3.3.15 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.