Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)

What to do

1. Check the running version on every Argo CD instance and upgrade to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2; move 2.x and 3.0-3.2 to a supported line.
2. Until upgraded, set jsonnet.enable to "false" in argocd-cm if you do not use Jsonnet, and remove --enable-helm from kustomize.buildOptions if you do not render Helm through Kustomize.
3. Restrict Git write access to repos backing restricted AppProjects, and limit who can delete Applications, create or update repositories, and call the API with Application get.
4. Rotate the Git, Helm and OCI credentials the repo-server holds if untrusted users had any of those paths.
5. After upgrading, review the application-controller's Kubernetes permissions so a bypass cannot reach cluster-wide RBAC.

How to check if you are affected or compromised

• Grep tracked repos for kustomizations with helmGlobals/configHome, remote refs whose ref or version starts with '-' or uses file://, and .jsonnet imports of absolute or ../ paths.
• Search manifests for argocd.argoproj.io/hook: PreDelete or PostDelete targeting namespaces or kinds outside the AppProject, and look for unexpected ClusterRoleBindings.
• Review repository and credential-template Secrets for unexpected proxy values on SSH repos, and API logs for manifestsWithFiles calls from unexpected users.

What happened#

On October 6, 2026, the Argo CD project shipped 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2. On October 7 it published eight security advisories, four of them critical at CVSS 3.1 9.9, as the release notes list. Each critical bug needs only low privileges, and each lets a tenant reach well past what Argo CD is supposed to allow them:

• CVE-2026-77459, AppProject bypass (GHSA-fmxq-cgp8-87wp). PreDelete and PostDelete hooks skip the AppProject destination and resource checks. When the Application is deleted, Argo CD creates them with the application-controller's credentials. Anyone who can push to the source repo can, for example, get a ClusterRoleBinding or an object in a forbidden namespace created.
• CVE-2026-113708, Kustomize remote ref (GHSA-9v9p-x54c-58gc). A remote base ref beginning with - is parsed as a git fetch option. --upload-pack with a file:// URL then runs a command in argocd-repo-server.
• CVE-2026-113709, Kustomize Helm config home (GHSA-fw5c-w8rc-j7fx). Where --enable-helm is set, helmGlobals.configHome can load a Helm downloader plugin from the repo, which then runs in the repo-server.
• CVE-2026-113672, Jsonnet import file read (GHSA-m3vr-7329-44ww). import and importstr can read absolute paths such as /proc/self/environ, the service-account token, and repository credentials.

A fifth, high-severity bug, CVE-2026-55797 (GHSA-j6cw-g6p4-7hch, 8.8), lets anyone who can set a proxy on an SSH repository inject shell commands into the repo-server.

Who is affected#

Every supported release before the fixed builds is affected. The bugs go back a long way: Jsonnet reads to v0.9.0, the Helm config home to v2.1.0, Kustomize refs to v2.7.0, and PostDelete hooks to v2.10.0. The advisories state that "Argo CD 2.x and 3.0 through 3.2 are out of support and will not receive a patch." Those versions need an upgrade to 3.3 or later, not a hotfix.

Do you really need to act?#

If your Argo CD is shared, yes. In a typical install the repo-server holds every Git, Helm and OCI credential, and the controller has broad cluster rights. Command execution in one, or object creation through the other, undoes your tenant isolation. The bar is low. The three repo-server bugs can be triggered by committing a file to a tracked repo. They can also be triggered by uploading it through POST /api/v1/applications/manifestsWithFiles, which, per the advisories, needs only Application get and no sync rights or Git access. Blocking repo-server egress does not stop the Kustomize ref bug, because a file:// remote never leaves the pod.

No exploitation has been reported. CISA's enrichment records "none" for CVE-2026-77459 on the CVE record, and none of these is in KEV. Single-team installs where only admins push and use the API face mostly insider risk.

What to do now#

1. Check versions with argocd version, or kubectl -n argocd get deploy argocd-repo-server -o jsonpath='{.spec.template.spec.containers[0].image}'. Then upgrade to 3.3.15, 3.4.10 or 3.5.4.
2. Until then, apply the advisories' workarounds. Set jsonnet.enable: "false" in argocd-cm if you don't use Jsonnet, and drop --enable-helm from kustomize.buildOptions; both are complete workarounds for their bug. For the Kustomize ref bug, the only stopgap is pinning Applications to Kustomize older than 5.0, and the AppProject hook bypass has no configuration fix.
3. Tighten RBAC: who can push to repos behind restricted AppProjects, who can delete Applications, who can add or edit repositories, and who holds Application get.
4. If untrusted users had any of these paths, rotate the credentials the repo-server can read.

How to tell if you were hit#

Grep tracked repositories for kustomizations that use helmGlobals/configHome or remote refs whose ref/version starts with - or uses file://. Also grep for .jsonnet files that import absolute or ../ paths. Search for resources annotated argocd.argoproj.io/hook: PreDelete or PostDelete that target namespaces or kinds the project forbids, and list recent ClusterRoleBinding objects (kubectl get clusterrolebindings --sort-by=.metadata.creationTimestamp). Review repository and credential-template Secrets for unexpected proxy values, and check API server logs for manifestsWithFiles calls from unexpected users.

Timeline#

• Oct 6, 2026 — Argo CD 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2 are released.
• Oct 7, 2026 — The project publishes eight advisories, four of them critical.
• Oct 13, 2026 — The CVE-2026-77459 record is published, and NVD lists it the same day.
• Oct 15, 2026 — GHSA-fmxq-cgp8-87wp enters the GitHub Advisory Database.
• Oct 20, 2026 — CVE records for CVE-2026-113708, -113709 and -113672 are published.

Vulnerability records

• CVE-2026-77459 · Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
• CVE-2026-113708 · Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
• CVE-2026-113709 · Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
• CVE-2026-113672 · Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
• CVE-2026-55797 · Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Argo CD — GHSA-fmxq-cgp8-87wp: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks github.com
2. Argo CD — GHSA-9v9p-x54c-58gc: A Kustomize remote ref can run commands in the repo-server github.com
3. Argo CD — GHSA-fw5c-w8rc-j7fx: A Kustomize Helm config home can run commands in the repo-server github.com
4. Argo CD — GHSA-m3vr-7329-44ww: A Jsonnet import can read files from the repo-server github.com
5. Argo CD — GHSA-j6cw-g6p4-7hch: Command injection via a repository proxy URL on SSH Git repositories github.com
6. Argo CD — v3.3.15 release notes github.com
7. CVE record — CVE-2026-77459 cve.org
8. NVD — CVE-2026-77459 nvd.nist.gov
9. Argo CD docs — Sync phases, waves and resource hooks argo-cd.readthedocs.io
10. GitHub Advisory Database — GHSA-fmxq-cgp8-87wp github.com