CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Attackers with Git write access can bypass Argo CD project restrictions via delete hooks, creating resources in forbidden namespaces or clusters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77459?
CVE-2026-77459 is a critical missing authorization vulnerability in argoproj argo-cd, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Weakness: CWE-863
Which versions are affected by CVE-2026-77459?
14 open source packages ship an affected version, including github.com/argoproj/argo-cd/v3, argo-cd and github.com/argoproj/argo-cd.
| Package | Affected | Fixed in |
|---|---|---|
github.com/argoproj/argo-cd/v3 Go | From 3.0.0 | 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2 |
github.com/argoproj/argo-cd/v3 Go | From 3.0.0 | 3.3.15 |
github.com/argoproj/argo-cd/v3 Go | From 3.0.0 | 3.3.15 |
github.com/argoproj/argo-cd/v3 Go | From 3.4.0 | 3.4.10 |
github.com/argoproj/argo-cd/v3 Go | From 3.4.0 | 3.4.10 |
github.com/argoproj/argo-cd/v3 Go | From 3.5.0 | 3.5.4 |
8 more packages
github.com/argoproj/argo-cd/v3 Go | From 3.5.0 | 3.5.4 |
github.com/argoproj/argo-cd/v3 Go | From 3.6.0-rc1 | 3.6.0-rc2 |
github.com/argoproj/argo-cd/v3 Go | From 3.6.0-rc1 | 3.6.0-rc2 |
argo-cd Bitnami | From 2.10.0 | 3.3.15, 3.4.10, 3.5.4 |
github.com/argoproj/argo-cd Go | All versions | None |
github.com/argoproj/argo-cd/v2 Go | From 2.10.0 | None |
github.com/argoproj/argo-cd/v2 Go | From 2.10.0 to 2.14.21 | None |
github.com/argoproj/argo-cd/v2 Go | From 2.10.0 to 2.14.21 | None |
How do I fix CVE-2026-77459?
Upgrade github.com/argoproj/argo-cd/v3 to a fixed version for your release line: 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77459 being exploited?
There is no known exploitation of CVE-2026-77459 in the wild and no public exploit code.
Sources
Also known as BIT-argo-cd-2026-77459, ECHO-cd0d-ea4a-763c, GHSA-fmxq-cgp8-87wp, GO-2026-6784, MINI-2g2h-8r69-vrwf, MINI-2hwq-x39g-w4qg and 22 more.