9.9

CVE-2026-77459: argoproj argo-cd Incorrect Authorization

CVSS: 9.9v3.1CriticalAwaiting analysis
AliasesGHSA-fmxq-cgp8-87wpCGA-3f8r-937r-95rgCGA-fchm-xv7j-c7mr
Published 13-10-2026Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2026-77459 is a critical (CVSS 9.9) Incorrect Authorization vulnerability in argoproj argo-cd. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.72%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-10-2026
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.72%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

14-10-202619-10-2026
EPSS score
0.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard8 products
  • argo-cd-3.1All versions (No fix recorded)
  • argo-cd-3.1-compatAll versions (No fix recorded)
  • argo-cd-3.2All versions (No fix recorded)
  • argo-cd-3.2-compatAll versions (No fix recorded)
  • argo-cd-fips-3.1All versions (No fix recorded)
Github.com/argoproj/argo-cd2 products
  • v2≥ 2.10.0, ≤ 2.14.21
  • v3≥ 3.0.0, < 3.3.15 | ≥ 3.4.0, < 3.4.10 | ≥ 3.5.0, < 3.5.4 | ≥ 3.6.0-rc1, < 3.6.0-rc2
Wolfi2 products
  • argo-cd-3.2All versions (No fix recorded)
  • argo-cd-3.2-compatAll versions (No fix recorded)
Argoproj1 product
  • argo-cd≥ 2.10.0, ≤ 2.14.21 | ≥ 3.0.0, < 3.3.15 | ≥ 3.4.0, < 3.4.10 | ≥ 3.5.0, < 3.5.4 | ≥ 3.6.0-rc1, < 3.6.0-rc2

4 vendors · 13 products

References

12 links
Show all 12 references