CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
Published Oct 13, 2026 · corrected/updated Oct 15, 2026 · evidence confidence high
### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD creates those hooks with the application-controller's credentials on the destination cluster. All versions from v2.10.0 onward are affected, including every currently supported release. v2.9.22 and earlier are not. PostDelete hooks were introduced in [dcc17f70bf](https://github.com/argoproj/argo-cd/commit/dcc17f70bf7db973fe480b8b613189b2c5ac4b4b) (2023-12-18, [#16595](https://github.com/argoproj/argo-cd/pull/16595)) and first released in v2.10.0. That creation path has never applied the project check. PreDelete hooks, added in [3bf3d8a212](https://github.com/argoproj/argo-cd/commit/3bf3d8a2124e772ac651f3fd42375c4e9b8008af) (2025-12-05, [#22288](https://github.com/argoproj/argo-cd/pull/22288)) and first released in v3.3.0, use the same path. v3.2.12 and earlier do not have PreDelete hooks. PreSync, Sync, PostSync, and SyncFail hooks still go through the project check. A user who can push to the Git repository an Application syncs from can commit a hook whose namespace, group, kind, or name the AppProject would refuse on sync. The controller adds the delete finalizer when it sees the hook, and the Application stays Synced until someone deletes it. Deleting the Application creates the hook. What that can reach is bounded by the application-controller's access to the destination cluster. In a typical install that access is broad, so a tenant can create a cluster-scoped object such as a , or an object in a namespace the project does not allow. A hook with no deletion policy is removed after it succeeds. A deletion policy that does not remove the hook on success leaves the object in the cluster. A hook such as a Job can create f
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-77459 is a critical public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: github.com/argoproj/argo-cd/v2 (>= 2.10.0, <= 2.14.21); github.com/argoproj/argo-cd/v2 (>=2.10.0 <=2.14.21); github.com/argoproj/argo-cd/v3 (>= 3.0.0, < 3.3.15); github.com/argoproj/argo-cd/v3 (>= 3.4.0, < 3.4.10). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 9.9, EPSS 0.7%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-863. Sources contributing to this record: cve_org, epss, github, gitlab. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an A
Oct 14, 2026 · NIST NVD
Updated
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an A
Oct 15, 2026 · GitHub Advisory Database
Updated
### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD creates those hooks with the application-controlle
Affected
- go github.com/argoproj/argo-cd/v2>= 2.10.0, <= 2.14.21
- go github.com/argoproj/argo-cd/v2>=2.10.0 <=2.14.21
- go github.com/argoproj/argo-cd/v3>= 3.0.0, < 3.3.15
- go github.com/argoproj/argo-cd/v3>= 3.4.0, < 3.4.10
- go github.com/argoproj/argo-cd/v3>= 3.5.0, < 3.5.4
- go github.com/argoproj/argo-cd/v3>= 3.6.0-rc1, < 3.6.0-rc2
- go github.com/argoproj/argo-cd/v3>=3.0.0 <3.3.15||>=3.4.0 <3.4.10||>=3.5.0 <3.5.4||>=3.6.0-rc1 <3.6.0-rc2
- golang github.comversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-77459
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-77459
30-day exploitation probability 0.7%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-fmxq-cgp8-87wp
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-77459
Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD creates those hooks with the application-controller's credent
advisories.gitlab.com - GitLab Advisory DatabasePackage advisorygo/github.com/argoproj/argo-cd/v2/CVE-2026-77459.yml
Argo CD checks an Application's AppProject before it creates resources + during a sync. That check covers destination namespaces and servers, cluster-scoped + resource allow and deny lists, and namespaced resource allow and deny lists, including + resource names. PreDelete and PostDelete hooks skip it. When the Application is + deleted, Argo CD creates those hooks with the application-controller's
gitlab.com - GitLab Advisory DatabasePackage advisorygo/github.com/argoproj/argo-cd/v3/CVE-2026-77459.yml
Argo CD checks an Application's AppProject before it creates resources + during a sync. That check covers destination namespaces and servers, cluster-scoped + resource allow and deny lists, and namespaced resource allow and deny lists, including + resource names. PreDelete and PostDelete hooks skip it. When the Application is + deleted, Argo CD creates those hooks with the application-controller's
gitlab.com - NIST NVDVulnerability recordCVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchroni
nvd.nist.gov