Argo CD Improper Resource Hook Management in Kubernetes
CVE-2026-77459
What is CVE-2026-77459?
Argo CD, a GitOps continuous delivery tool for Kubernetes, has a vulnerability that arises from the improper management of PostDelete resource hooks. This issue occurs in specific versions between 2.10.0 and 3.6.0-rc2, where the software bypasses AppProject destination and resource authorization checks during the creation of delete hooks. As a result, a user with write access to an Application's Git repository can implement a deletion hook that may target restricted resources or namespaces. This can lead to unauthorized resource management in the cluster, including the potential creation of persistent hooks and secondary objects without proper controls. The vulnerability has been addressed in the latest releases, ensuring that resource hooks adhere to standard project authorization checks.
Affected Version(s)
argo-cd >= 2.10.0, <= 2.14.21 <= 2.10.0, 2.14.21
argo-cd >= 3.0.0, < 3.3.15 < 3.0.0, 3.3.15
argo-cd >= 3.4.0, < 3.4.10 < 3.4.0, 3.4.10