CVE-2026-77459

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Argo CD via PostDelete Hook

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77459

EUVD

EUVD-2026-98917

Affected Vendors & Products

Vendor	Product	Version / Range
argoproj	argo-cd	>= 2.10.0, <= 2.14.21
argoproj	argo-cd	>= 3.0.0, < 3.3.15
argoproj	argo-cd	>= 3.4.0, < 3.4.10
argoproj	argo-cd	>= 3.5.0, < 3.5.4
argoproj	argo-cd	>= 3.6.0-rc1, < 3.6.0-rc2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Argo CD versions 2.10.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 have a flaw where PostDelete resource hooks are created without applying AppProject destination and resource authorization checks. This allows users with Git repository write access to commit a delete hook targeting unauthorized namespaces, clusters, or resources. When the Application is deleted, the application-controller creates the forbidden resource using its cluster credentials.

Detection Guidance

To detect this vulnerability, check Argo CD versions between 2.10.0 and 3.3.14, 3.4.9, 3.5.3, and 3.6.0-rc1. Inspect Git repositories for Applications with PreDelete or PostDelete hooks targeting forbidden namespaces or resource types. Use kubectl to review Application resources and their associated hooks for unauthorized configurations.

Impact Analysis

An attacker with Git write access could delete unauthorized resources in your Kubernetes cluster, including cluster-scoped resources, disallowed namespaces, or persistent hook objects. The impact is limited by the controller's cluster access but could lead to data loss, unauthorized modifications, or secondary object creation via a hook Job.

Compliance Impact

This vulnerability could lead to unauthorized resource creation or access in restricted namespaces, potentially violating data protection requirements under GDPR (e.g., unauthorized access to personal data) or HIPAA (e.g., unauthorized access to protected health information). The ability to bypass AppProject restrictions may result in non-compliance with access control and segregation of duties requirements mandated by these regulations.

Mitigation Strategies

Upgrade Argo CD to a patched version (3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later) to address the missing authorization checks in PostDelete hooks.

Hi! I’m here to help you understand CVE-2026-77459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70