Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77459— Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Quick assessment

Affected
argoproj argo-cd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Argo CD 是一款用于 Kubernetes 的声明式、GitOps 持续交付工具。在 2.10.0 版本至 3.3.15、3.4.10、3.5.4 和 3.6.0-rc2 版本（含 2.10.0 和 3.6.0-rc2）中，Argo CD 在创建 PostDelete 资源钩子时，未执行常规同步过程中所用的 AppProject 目标位置和资源配置授权检查。被跳过的检查包括集群级和命名空间级别的资源允许/拒绝列表。 能够向 Application 的 Git 仓库写入内容的用户，可以提交一个目标为被禁止的命名

CVSS 9.9 · Critical

Affected Version Matrix 5

VendorProduct Version RangeStatus
argoproj argo-cd >= 2.10.0, <= 2.14.21 affected
>= 3.0.0, < 3.3.15 affected
>= 3.4.0, < 3.4.10 affected
>= 3.5.0, < 3.5.4 affected
>= 3.6.0-rc1, < 3.6.0-rc2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77459

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Source: CVE Program / CVE List V5
Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
argoproj argo-cd >= 2.10.0, <= 2.14.21 -

II. Public POCs for CVE-2026-77459

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77459

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77459 (1)

Vendor Pages for CVE-2026-77459 (4)

IV. Related Vulnerabilities

Same product: argo-cd
Same vendor: argoproj
Same weakness: CWE-863

V. Comments for CVE-2026-77459

No comments yet

Leave a comment