DEV Community

StarkMan
StarkMan

Posted on

Shared Responsibility in Argo CD: Who Owns Each Part of CVE-2026-77459 and Its Siblings

#argocd #cve202677459 #kubernetes #gitops

Shared Responsibility in Argo CD: Who Owns Each Part of CVE-2026-77459 and Its Siblings

Vulnerability overview

Four CVSS 9.9 vulnerabilities were fixed in Argo CD in October 2026. Whether the fix is purely a vendor action depends on the flaw. Three are repository-content issues inside argocd-repo-server; CVE-2026-77459 is an AppProject enforcement gap on PreDelete and PostDelete hooks. No confirmed exploitation and no public proof-of-concept have been reported.

Mechanism and exploitation conditions

The maintainers supply fixed releases, but the exploitation conditions live in deployment choices. The Kustomize Helm path applies when operators enable Helm chart rendering in Kustomize, because a kustomization can then point Helm at a folder inside the repository and Helm loads and runs a plugin from it as the repo-server user. The Kustomize remote-reference path depends on how remote bases are fetched: a version value reaches Git without separation from command-line options, letting a crafted value run a command, and the advisory notes blocking repo-server egress does not stop it. The Jsonnet path depends on whether Jsonnet is enabled at all, since its importer can read the process environment, service-account tokens, private keys, repository credentials and device files.
CVE-2026-77459 depends on repository write access and on deletion rights. Argo CD checks an Application's AppProject before creating resources during a sync — destination namespaces and servers, cluster-scoped allow and deny lists, namespaced allow and deny lists — but PreDelete and PostDelete hooks skipped that check. A Git writer commits a hook the project would refuse, and the deletion causes Argo CD to create it with the controller's credentials, potentially a cluster-wide role binding. PreSync and PostSync hooks still pass through the check.

Impact

Two layers therefore divide responsibility. The vendor must issue fixed releases. The platform team must own which features are enabled, who can write repository content, and who can delete Applications. A configuration that leaves jsonnet.enable or Helm rendering enabled while repository access is broad keeps exploitation conditions intact even after an upgrade is scheduled.

Affected products and scope

Flaw Affected from
Kustomize Helm config home v2.1.0 and later
Kustomize remote ref v2.7.0 and later
Jsonnet file read v0.9.0 and later
AppProject hook bypass (CVE-2026-77459) v2.10.0 and later

Every currently supported release is affected. Argo CD 2.x and 3.0 through 3.2 will not be patched.

Remediation and mitigations

Upgrade to v3.5.4, v3.4.10, v3.3.15 or v3.6.0-rc2. Interim options documented in the advisories are removing --enable-helm from Kustomize build options, setting jsonnet.enable to false in argocd-cm, and pinning Kustomize below 5.0 such as 4.5.7, each with functional cost. Limiting who can push to Git repositories and who can delete Applications addresses the CVE-2026-77459 precondition directly; restricting Application get access only closes the upload route, not the Git route.

References

Top comments (0)