Threats tagged 'ghsa-fmxq-cgp8-87wp'

CVE-2026-77459 is a critical authorization vulnerability in Argo CD affecting versions from 2.10.0 onward. It allows users with write access to Git repositories backing Applications to create PreDelete and PostDelete hooks that bypass AppProject authorization checks. These hooks run with the application-controller's credentials on the destination cluster during Application deletion, potentially enabling unauthorized creation of cluster-scoped or namespace-scoped resources. The vulnerability is patched in Argo CD versions 3.3.15 and later, including 3.4.10, 3.5.4, and 3.6.0-rc2. Versions 2.x and 3.0 through 3.2 are out of support and will not receive patches. Mitigations include restricting write access to Git repositories, limiting who can delete Applications, and tightening the application-controller's Kubernetes permissions.