Patching Argo CD to v3.5.4, v3.4.10, v3.3.15 or v3.6.0-rc2: A Migration Checklist
Patching Argo CD to v3.5.4, v3.4.10, v3.3.15 or v3.6.0-rc2: A Migration Checklist Vulnerability overview The Argo CD project fixed four CVSS 9.9 vulnerabilities in October 2026. Their identifiers matter for the upgrade plan: CVE-2026-77459 — the AppProject check is skipped for PreDelete and PostDelete hooks, so a Git committer can have a hook created with the controller's credentials on…
The Argo CD project released patches for four critical vulnerabilities in October 2026. These vulnerabilities are identified by CVE-2026-77459, Kustomize Helm config home, Kustomize remote ref, and Jsonnet file read. Each of these flaws can be exploited if certain preconditions are met, such as repository content, an Application upload path with get permissions, or Git write access combined with the ability to delete an Application.
The vulnerabilities can lead to compromise of the repo-server, exposing credentials and secrets, and potentially translating repository write access into controller-level permissions. All currently supported releases of Argo CD are affected, including 3.0 through 3.2 which are out of support. To remediate the vulnerabilities, users should upgrade to v3.5.4, v3.4.10, v3.3.15, or v3.6.0-rc2.
Interim mitigations include removing --enable-helm from Kustomize build options, setting jsonnet.enable to false in the argocd-cm ConfigMap, pinning Kustomize to a version before 5.0, and limiting access to tracked Git repositories and Application deletions. However, these interim measures may not provide complete protection and upgrading is recommended.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
