Argo CD v3.5.4 Critical Vulnerabilities: RCE via Kustomize/Jsonnet, File Read, and Authorization Bypass (GHSA/CVE-2026-77450)

Vulnerability Overview Several critical security vulnerabilities exist in Argo CD v3.5.4, as detailed below: 1. CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc) - Description: Kustomize remote references can execute commands in the repo-server. 2. CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-7fx) - Description: A Kustomize Helm configuration home directory can execute commands in the repo-server. 3. CRITICAL: A jsonnet import can read files from the repo-server (GHSA-m3or-7329-44ww) - Description: A jsonnet import can read files from the repo-server. 4. CRITICAL: An Approved restriction bypassed by PreDelete/PostDelete resource hooks (GHSA-fm2n-mnk8-72am, CVE-2026-77450) - Description: The "Approved" restriction can be bypassed via PreDelete/PostDelete resource hooks. Affected Scope These vulnerabilities affect Argo CD v3.5.4 and may lead to the following risks: Command Execution: Attackers may execute arbitrary commands on the repo-server. File Reading: Attackers can read sensitive files from the repo-server. Permission Bypass: Attackers can bypass "Approved" restrictions to perform unauthorized operations. Remediation It is recommended that users upgrade to the latest version to patch these security vulnerabilities. Specific steps are outlined below: 1. Upgrade Argo CD - Visit the Argo CD Official Documentation for the latest upgrade guides. - Follow the steps in the documentation to upgrade, ensuring all components are updated to the latest version. 2. Verify the Upgrade - After the upgrade, verify that all functionalities are operating normally, particularly those related to security. 3. Monitor and Audit - Post-upgrade, continuously monitor and audit the system to ensure no new security vulnerabilities emerge. POC Code No specific POC code or exploit code is provided in the source material. --- This summary covers the critical security vulnerabilities in Argo CD v3.5.4. It is recommended to implement remediation measures as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Argo CD v3.5.4 Critical Vulnerabilities: RCE via Kustomize/Jsonnet, File Read, and Authorization Bypass (GHSA/CVE-2026-77450)

More from this source