Read the docs
TI-2026-71916 Aliases CVE-2026-77459GHSA-fmxq-cgp8-87wp

Argo CD delete hooks bypass AppProject resource restrictions

Priority MEDIUM 43CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Argo CD from 2.10.0 through 2.14.21, from 3.0.0 before 3.3.15, from 3.4.0 before 3.4.10, from 3.5.0 before 3.5.4 and from 3.6.0-rc1 before 3.6.0-rc2 is affected. PostDelete resource hooks skip the AppProject destination and resource allow and deny checks (CWE-863). A user who can write to an Application's Git repository can add a delete hook targeting a forbidden namespace or resource, which the controller creates when the Application is deleted.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Fix Fixed argo-cd (argoproj): 3.3.15, 3.4.10, 3.5.4 +1github.com/argoproj/argo-cd/v3 (Go): 3.3.15, 3.4.10, 3.5.4 +1Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-cd2.10.0 – 2.14.21; 3.0.0 to before 3.3.15; 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.4; 3.6.0-rc1 to before 3.6.0-rc23.3.15, 3.4.10, 3.5.4, 3.6.0-rc2Patch availableCNA
—github.com/argoproj/argo-cd/v2 (Go)2.10.0 – 2.14.21—No fix listedGHSA-fmxq-cgp8-87wp
—github.com/argoproj/argo-cd/v3 (Go)3.0.0 to before 3.3.153.3.15Patch availableGHSA-fmxq-cgp8-87wp
—github.com/argoproj/argo-cd/v3 (Go)3.4.0 to before 3.4.103.4.10Patch availableGHSA-fmxq-cgp8-87wp
—github.com/argoproj/argo-cd/v3 (Go)3.5.0 to before 3.5.43.5.4Patch availableGHSA-fmxq-cgp8-87wp
—github.com/argoproj/argo-cd/v3 (Go)3.6.0-rc1 to before 3.6.0-rc23.6.0-rc2Patch availableGHSA-fmxq-cgp8-87wp
  • argo-cd Vendorargoproj Affected 2.10.0 – 2.14.21; 3.0.0 to before 3.3.15; 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.4; 3.6.0-rc1 to before 3.6.0-rc2 Fixed in 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2 Patch available CNA
  • github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.10.0 – 2.14.21 Fixed in — No fix listed GHSA-fmxq-cgp8-87wp
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.0.0 to before 3.3.15 Fixed in 3.3.15 Patch available GHSA-fmxq-cgp8-87wp
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.4.0 to before 3.4.10 Fixed in 3.4.10 Patch available GHSA-fmxq-cgp8-87wp
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.5.0 to before 3.5.4 Fixed in 3.5.4 Patch available GHSA-fmxq-cgp8-87wp
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.6.0-rc1 to before 3.6.0-rc2 Fixed in 3.6.0-rc2 Patch available GHSA-fmxq-cgp8-87wp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*——argoproj
  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions — — ·argoproj

Remediation

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 depending on the release line. Red Hat fixes OpenShift GitOps 1.20 in RHSA-2026:77273, 1.21 in RHSA-2026:77269 and 1.22 in RHSA-2026:77267. The sources list no fixed version for argo-cd.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA argo-cd (argoproj) Fixed in 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2
  • Fix · GHSA-fmxq-cgp8-87wp github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.3.15 Advisory →
  • Fix · GHSA-fmxq-cgp8-87wp github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.4.10 Advisory →
  • Fix · GHSA-fmxq-cgp8-87wp github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.5.4 Advisory →
  • Fix · GHSA-fmxq-cgp8-87wp github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.6.0-rc2 Advisory →

Red Hat 3 advisories

  • RHSA-2026:77273 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.8 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:77267 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.22.1 security update
    • Red Hat OpenShift GitOps 1.22 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:77273
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Red Hat OpenShift GitOps 1.22Fixed RHSA-2026:77267
Not affected: 5 products
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift GitOps 1.22
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-77459
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-fmxq-cgp8-87wp
  4. 2026-10-16 Fix available: Go/github.com/argoproj/argo-cd/[email protected], Go/github.com/argoproj/argo-cd/[email protected], Go/github.com/argoproj/argo-cd/[email protected] +1 · GHSA-fmxq-cgp8-87wp
  5. 2026-10-16 CVSS score added · GHSA-fmxq-cgp8-87wp
  6. 2026-10-16 Weakness changed · GHSA-fmxq-cgp8-87wp
  7. 2026-10-16 11 new references · GHSA-fmxq-cgp8-87wp
  8. 2026-10-20 Affected versions changed · Red Hat
  9. 2026-10-21 Fix available: RHSA-2026:77273 · Red Hat
  10. 2026-10-21 Fix available: RHSA-2026:77269 · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:77267 · Red Hat
  12. 2026-10-21 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21, Red Hat OpenShift GitOps 1.22 · Red Hat
  13. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 10

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
  • TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
  • TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
  • TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences