Patching Argo CD to v3.5.4, v3.4.10, v3.3.15 or v3.6.0-rc2: A Migration Checklist

Vulnerability overview

The Argo CD project fixed four CVSS 9.9 vulnerabilities in October 2026. Their identifiers matter for the upgrade plan:

• CVE-2026-77459 — the AppProject check is skipped for PreDelete and PostDelete hooks, so a Git committer can have a hook created with the controller's credentials on Application deletion.
• Kustomize Helm config home — a Kustomize build that renders Helm charts can load and run a plugin from a folder inside the repository as the repo-server user.
• Kustomize remote ref — a version value reaches Git without being separated from command-line options, allowing command execution from a crafted value. The advisory notes that blocking repo-server egress does not prevent it.
• Jsonnet file read — the importer can open any path the repo-server can read, including the process environment, service-account tokens, private keys and repository credentials. The maintainers report no confirmed exploitation in the wild and no public proof-of-concept.

Mechanism and exploitation conditions

These are not remote unauthenticated bugs. Each has a precondition: repository content, an Application upload path that needs only get on an existing Application, or Git write access combined with the ability to delete an Application. Planning a patch window means knowing which of those preconditions exist in your installation.

Impact

Compromise of the repo-server exposes credentials and secrets. The AppProject bypass can translate repository write access into controller-level permissions, which in a typical install can include a cluster-wide role binding.

Affected products and scope

Flaw	Affected from
Kustomize Helm config home	v2.1.0 and later
Kustomize remote ref	v2.7.0 and later
Jsonnet file read	v0.9.0 and later
AppProject hook bypass (CVE-2026-77459)	v2.10.0 and later

Every currently supported release is affected. Argo CD 2.x and 3.0 through 3.2 are out of support and will not be patched, so those installations need a supported target rather than a backport.

Remediation and mitigations

Move to v3.5.4, v3.4.10, v3.3.15 or v3.6.0-rc2. Where the upgrade has to wait, the advisories document these interim reductions: remove --enable-helm from Kustomize build options; set jsonnet.enable to false in the argocd-cm ConfigMap; pin Kustomize to a version before 5.0 such as 4.5.7; and limit who can push to the tracked Git repositories and who can delete Applications. Each workaround costs functionality, and the remote-reference advisory records that no complete workaround exists besides upgrading. Restricting Application get closes only one route into the repo-server flaws, not the Git route.

References

• SecurityOnline, "Argo CD Patches Four Critical CVSS 9.9 Flaws Affecting the Repo-Server and AppProject Controls", https://securityonline.info/argo-cd-vulnerabilities-cvss-9-9/
• Project advisories referenced by the report: GHSA-fmxq-cgp8-87wp, GHSA-m3vr-7329-44ww, GHSA-9v9p-x54c-58gc, GHSA-fw5c-w8rc-j7fx