CVE-2026-77459

Summary

Argo CD allows users with write access to Application Git repositories to create PostDelete hooks that bypass normal authorization checks, potentially enabling deletion of forbidden cluster-scoped resources or objects in disallowed namespaces. This creates a privilege escalation vector where attackers can delete critical system resources through crafted hook definitions.

Exploitability

Exploitation requires a user with write access to an Application's Git repository, which is typically less privileged than cluster admin, making it moderately easy to achieve initial compromise before leveraging this vulnerability.

Blast radius

The impact could include deletion of cluster-scoped resources like CRDs, namespaces, or persistent objects, potentially affecting multiple applications and the overall Kubernetes cluster stability.

Detection

Monitor for Application resource changes in the Argo CD controller logs that include PostDelete hook definitions, particularly when these hooks target cluster-scoped resources or namespaces not permitted by the AppProject configuration.

Prioritized remediation

Upgrade to Argo CD version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 immediately to remediate this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.