CVE-2026-77459

Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it.

No known exploitation

Severity

Critical, CVSS 9.9 (v3.1)

EPSS

0.72% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)

Affected packages

• github.com/argoproj/argo-cd/v2 (go) >= 2.10.0, <= 2.14.21, no fix yet · GHSA-fmxq-cgp8-87wp
• github.com/argoproj/argo-cd/v3 (go) >= 3.0.0, < 3.3.15, fixed in 3.3.15 · GHSA-fmxq-cgp8-87wp
• github.com/argoproj/argo-cd/v3 (go) >= 3.4.0, < 3.4.10, fixed in 3.4.10 · GHSA-fmxq-cgp8-87wp
• github.com/argoproj/argo-cd/v3 (go) >= 3.5.0, < 3.5.4, fixed in 3.5.4 · GHSA-fmxq-cgp8-87wp
• github.com/argoproj/argo-cd/v3 (go) >= 3.6.0-rc1, < 3.6.0-rc2, fixed in 3.6.0-rc2 · GHSA-fmxq-cgp8-87wp