Argo CD Patched Critical Auth Bypass in PostDelete Hooks
A critical flaw in Argo CD allows attackers to bypass authorization checks, enabling privilege escalation within Kubernetes clusters.
Key points
- CVE-2026-77459 carries a CVSS 9.9 score due to missing authorization checks on PostDelete hooks.
- Exploitation requires write access to an Application's Git repository to commit malicious deletion hooks.
- Fixes are available in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Argo CD has released patches for a critical vulnerability that allows attackers to bypass cluster authorization checks. The flaw, identified as CVE-2026-77459, affects the declarative GitOps continuous delivery tool for Kubernetes. According to the National Vulnerability Database, the issue enables unauthorized resource creation.
At a glance
- CVE
- CVE-2026-77459
- Product
- argoproj argo-cd
- CVSS
- 9.9 Critical
- Weakness
- incorrect authorization
- Exploited
- No known exploitation
The vulnerability exists because Argo CD versions from 2.10.0 through specific earlier releases fail to apply AppProject destination and resource authorization checks when creating PostDelete resource hooks. Ordinary synchronization processes enforce these security boundaries, but the PostDelete hook creation process skips them. This omission removes protections for cluster-scoped and namespaced resource allow or deny lists.
How the Attack Works
An attacker who possesses write access to an Application's Git repository can exploit this gap. By committing a delete hook that targets a forbidden namespace, server, group, kind, or resource name, the attacker can trigger unauthorized actions. When the Application is subsequently deleted, the application-controller executes the hook.
The application-controller creates the targeted resource using the credentials of the destination cluster. This action occurs despite the resource being outside the allowed scope defined by the AppProject. The impact is limited by the controller's existing cluster access permissions, but it remains significant.
Scope of Impact
The reach of this vulnerability depends on the access level of the Argo CD application-controller. Attackers can potentially create cluster-scoped resources that are normally restricted. They may also target disallowed namespaces within the Kubernetes environment.
Additionally, the flaw allows the creation of persistent hook objects. Secondary objects generated by a hook Job can also be created without proper authorization. These capabilities extend the attacker's influence beyond the initial intended scope of the application deployment.
Affected Versions
Multiple versions of Argo CD are vulnerable to this authorization bypass. The issue affects all releases from version 2.10.0 up to and including 2.14.21. Users of the 3.0.0 series are also at risk if they have not updated to the latest patched release.
Specifically, versions 3.0.0 through 3.3.14 are affected. The 3.4.0 series is vulnerable up to version 3.4.9. Users on the 3.5.0 series are exposed until version 3.5.3. The vulnerability was present in versions prior to the fixed 3.6.0-rc2 release.
What should you do?
Organizations using Argo CD should immediately verify their current version against the affected list. If running a vulnerable version, administrators must upgrade to the patched releases. The fixes are available in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Other hook types remain secure. PreSync, Sync, PostSync, and SyncFail hooks continue to use normal project authorization checks. These hooks are not affected by CVE-2026-77459 and do not require immediate remediation for this specific flaw.
What to do and how to stay safe: Argo CD
- Audit all Argo CD instances to confirm whether they run versions between 2.10.0 and the patched releases listed in the advisory.
- Review Git repositories associated with Argo CD Applications for any unauthorized PostDelete hooks that target forbidden namespaces or cluster-scoped resources.
- Restrict write access to Argo CD Application Git repositories to trusted personnel only, reducing the attack surface for this specific vector.
- Monitor Kubernetes audit logs for unexpected resource creation events triggered by the application-controller, especially during application deletions.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-77459?
It is a critical vulnerability in Argo CD where PostDelete hooks bypass AppProject authorization checks, allowing unauthorized resource creation.
Which Argo CD versions are fixed?
The issue is resolved in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Do other hook types need updating?
No, PreSync, Sync, PostSync, and SyncFail hooks still enforce normal project checks and are not affected by this specific flaw.
