CVE-2026-77459: Argo CD Privilege Escalation Vulnerability

CVE-2026-77459 Overview

Argo CD, the declarative GitOps continuous delivery tool for Kubernetes, contains an authorization bypass in its PostDelete resource hook execution path. From version 2.10.0 up to the fixed releases, the application-controller creates PostDelete hook resources without applying the AppProject destination and resource authorization checks that normally gate synchronization. A user with write access to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name. Deleting the Application then causes the controller to instantiate that resource using its destination-cluster credentials. The issue is tracked as [CWE-863: Incorrect Authorization] and fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Critical Impact
An attacker with Git write access can create cluster-scoped resources, write to disallowed namespaces, and spawn secondary objects via hook Jobs, bounded only by the controller's cluster permissions.

Affected Products

Argo CD versions 2.10.0 through 3.3.14
Argo CD 3.4.0 through 3.4.9
Argo CD 3.5.0 through 3.5.3 and 3.6.0-rc1

Discovery Timeline

2026-10-13 - CVE CVE-2026-77459 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-77459

Vulnerability Analysis

Argo CD uses the AppProject custom resource to enforce boundaries on where and what an Application may deploy. These boundaries include destination cluster and namespace allow lists, plus clusterResourceWhitelist, clusterResourceBlacklist, namespaceResourceWhitelist, and namespaceResourceBlacklist entries. Normal PreSync, Sync, PostSync, and SyncFail hooks route through these checks.

The PostDelete hook path in controller/appcontroller.go skipped project enforcement. When the application-controller invoked executePreDeleteHooks without the destCluster context, hook manifests committed to Git were materialized directly through the controller's privileged service account. The impact scope is defined by what that service account can create in the connected clusters.

Root Cause

The root cause is a missing authorization check on the PostDelete hook creation code path. The function responsible for executing pre-delete hooks did not receive or evaluate the destination cluster and project resource allow/deny lists before applying manifests. This is a classic [CWE-863] incorrect authorization defect where one code path diverges from the enforcement model applied elsewhere.

Attack Vector

An attacker who can commit to an Application's source Git repository adds a manifest annotated as a PostDelete hook, such as a ClusterRoleBinding, a Secret in kube-system, or a Job that creates further resources. When the Application is deleted, the controller creates the hook resource with its destination-cluster credentials, bypassing AppProject restrictions.

// Patch excerpt from controller/appcontroller.go
// Source: https://github.com/argoproj/argo-cd/commit/1149cdc6e932208c4402183cc3d7b7485239940c

        return fmt.Errorf("error getting permitted app live objects: %w", err)
    }

-   done, err := ctrl.executePreDeleteHooks(app, proj, objsMap, config, logCtx)
+   done, err := ctrl.executePreDeleteHooks(app, proj, destCluster, objsMap, config, logCtx)
    if err != nil {
        return fmt.Errorf("error executing pre-delete hooks: %w", err)
    }

The fix threads destCluster into executePreDeleteHooks so project authorization is enforced before hook objects are applied. See the Argo CD Security Advisory GHSA-fmxq-cgp8-87wp.

Detection Methods for CVE-2026-77459

Indicators of Compromise

Resources with the annotation argocd.argoproj.io/hook: PostDelete targeting namespaces or kinds not listed in the owning AppProject.
Cluster-scoped objects created by the Argo CD application-controller service account shortly after an Application deletion event.
Hook Job pods created in kube-system, argocd, or other sensitive namespaces originating from Application teardown.

Detection Strategies

Audit Kubernetes API server logs for create verbs issued by the argocd-application-controller service account on resources outside the project's permitted scope.
Correlate Application delete events with subsequent resource creation timestamps to flag unexpected hook execution.
Scan Git repositories backing Argo CD Applications for manifests carrying the PostDelete hook annotation and review their target resource types.

Monitoring Recommendations

Enable Kubernetes audit logging at RequestResponse level for the argocd namespace and the application-controller service account.
Alert on creations of ClusterRoleBinding, ClusterRole, Secret, or ServiceAccount resources attributed to Argo CD outside expected project namespaces.
Track Application lifecycle events (DeletionTimestamp set) and emit alerts if hook resources are created in restricted namespaces afterward.

How to Mitigate CVE-2026-77459

Immediate Actions Required

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 as applicable to your release channel.
Review all existing Applications for PostDelete hooks in their source repositories and remove any that target resources outside the AppProject scope.
Restrict Git write access to Application source repositories and enforce signed commits and mandatory review.

Patch Information

The fix is published in Argo CD releases v3.3.15, v3.4.10, v3.5.4, and v3.6.0-rc2. The core change passes destCluster into executePreDeleteHooks so project-level destination and resource authorization is enforced for PostDelete hooks. See commits 1149cdc, 4bc8085, 7f0a058, and d5dd701.

Workarounds

Tighten the Kubernetes RBAC granted to the Argo CD application-controller service account to the minimum required cluster and namespace scope.
Temporarily remove or deny PostDelete hook manifests via admission policies (OPA Gatekeeper or Kyverno) that block resources carrying the argocd.argoproj.io/hook: PostDelete annotation outside allowed namespaces.
Require pull-request approval and branch protection on Application source repositories to prevent unilateral introduction of malicious hooks.

bash

# Example Kyverno policy to block PostDelete hooks outside permitted namespaces
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-argocd-postdelete-hooks
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-postdelete-outside-allowed
      match:
        any:
          - resources:
              kinds:
                - "*"
      preconditions:
        all:
          - key: "{{ request.object.metadata.annotations.\"argocd.argoproj.io/hook\" || '' }}"
            operator: Equals
            value: PostDelete
      validate:
        message: "PostDelete hooks are restricted pending CVE-2026-77459 remediation."
        deny:
          conditions:
            all:
              - key: "{{ request.object.metadata.namespace }}"
                operator: NotIn
                value: ["app-team-a", "app-team-b"]