---
title: "Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)"
url: https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/
description: "Argo CD 3.3.15, 3.4.10 and 3.5.4 fix four critical flaws: repo-server command execution, file read, and an AppProject bypass. 2.x gets no fix. Patch this week."
type: security-brief
section: "Security Digest"
date_published: 2026-10-07
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-77459", "CVE-2026-113708", "CVE-2026-113709", "CVE-2026-113672", "CVE-2026-55797"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Argo CD: Repo-Server RCE and AppProject Bypass (Oct 2026)

**Verdict: Patch this week.** Upgrade Argo CD to a patched 3.3, 3.4 or 3.5 release this week, and today on shared instances where people you do not fully trust can push to tracked repos or merely view an Application.

- **Who must act:** Teams running Argo CD 2.x or 3.x, most urgently multi-tenant installs where developers, tenants or CI bots can push to tracked Git repos, hold Application get, or manage repositories.
- **Who can relax:** Single-team installs where only platform admins can push to tracked repos and use the Argo CD API carry less risk, but should still upgrade on a normal short cycle.
- **Affected:** Argo CD 3.3 before 3.3.15; Argo CD 3.4 before 3.4.10; Argo CD 3.5 before 3.5.4; Argo CD 3.6.0-rc1; Argo CD 2.x and 3.0-3.2 (out of support; no patch)
- **Fixed:** Argo CD 3.3.15; Argo CD 3.4.10; Argo CD 3.5.4; Argo CD 3.6.0-rc2
- **CVEs:** CVE-2026-77459, CVE-2026-113708, CVE-2026-113709, CVE-2026-113672, CVE-2026-55797
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Check the running version on every Argo CD instance and upgrade to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2; move 2.x and 3.0-3.2 to a supported line.
2. Until upgraded, set jsonnet.enable to "false" in argocd-cm if you do not use Jsonnet, and remove --enable-helm from kustomize.buildOptions if you do not render Helm through Kustomize.
3. Restrict Git write access to repos backing restricted AppProjects, and limit who can delete Applications, create or update repositories, and call the API with Application get.
4. Rotate the Git, Helm and OCI credentials the repo-server holds if untrusted users had any of those paths.
5. After upgrading, review the application-controller's Kubernetes permissions so a bypass cannot reach cluster-wide RBAC.

### How to check if you are affected

- Grep tracked repos for kustomizations with helmGlobals/configHome, remote refs whose ref or version starts with '-' or uses file://, and .jsonnet imports of absolute or ../ paths.
- Search manifests for argocd.argoproj.io/hook: PreDelete or PostDelete targeting namespaces or kinds outside the AppProject, and look for unexpected ClusterRoleBindings.
- Review repository and credential-template Secrets for unexpected proxy values on SSH repos, and API logs for manifestsWithFiles calls from unexpected users.

## What happened

On October 6, 2026, the Argo CD project shipped 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2. On October 7 it published eight security advisories, four of them critical at CVSS 3.1 9.9, as the [release notes](https://github.com/argoproj/argo-cd/releases/tag/v3.3.15) list. Each critical bug needs only low privileges, and each lets a tenant reach well past what Argo CD is supposed to allow them:

- **CVE-2026-77459, AppProject bypass** ([GHSA-fmxq-cgp8-87wp](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp)). PreDelete and PostDelete hooks skip the AppProject destination and resource checks. When the Application is deleted, Argo CD creates them with the application-controller's credentials. Anyone who can push to the source repo can, for example, get a `ClusterRoleBinding` or an object in a forbidden namespace created.
- **CVE-2026-113708, Kustomize remote ref** ([GHSA-9v9p-x54c-58gc](https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc)). A remote base `ref` beginning with `-` is parsed as a `git fetch` option. `--upload-pack` with a `file://` URL then runs a command in `argocd-repo-server`.
- **CVE-2026-113709, Kustomize Helm config home** ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)). Where `--enable-helm` is set, `helmGlobals.configHome` can load a Helm downloader plugin from the repo, which then runs in the repo-server.
- **CVE-2026-113672, Jsonnet import file read** ([GHSA-m3vr-7329-44ww](https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww)). `import` and `importstr` can read absolute paths such as `/proc/self/environ`, the service-account token, and repository credentials.

A fifth, high-severity bug, CVE-2026-55797 ([GHSA-j6cw-g6p4-7hch](https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch), 8.8), lets anyone who can set a proxy on an SSH repository inject shell commands into the repo-server.

## Who is affected

Every supported release before the fixed builds is affected. The bugs go back a long way: Jsonnet reads to v0.9.0, the Helm config home to v2.1.0, Kustomize refs to v2.7.0, and PostDelete hooks to v2.10.0. The advisories state that "Argo CD 2.x and 3.0 through 3.2 are out of support and will not receive a patch." Those versions need an upgrade to 3.3 or later, not a hotfix.

## Do you really need to act?

If your Argo CD is shared, yes. In a typical install the repo-server holds every Git, Helm and OCI credential, and the controller has broad cluster rights. Command execution in one, or object creation through the other, undoes your tenant isolation. The bar is low. The three repo-server bugs can be triggered by committing a file to a tracked repo. They can also be triggered by uploading it through `POST /api/v1/applications/manifestsWithFiles`, which, per the advisories, needs only Application `get` and no sync rights or Git access. Blocking repo-server egress does not stop the Kustomize ref bug, because a `file://` remote never leaves the pod.

No exploitation has been reported. CISA's enrichment records "none" for CVE-2026-77459 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-77459), and none of these is in KEV. Single-team installs where only admins push and use the API face mostly insider risk.

## What to do now

1. Check versions with `argocd version`, or `kubectl -n argocd get deploy argocd-repo-server -o jsonpath='{.spec.template.spec.containers[0].image}'`. Then upgrade to 3.3.15, 3.4.10 or 3.5.4.
2. Until then, apply the advisories' workarounds. Set `jsonnet.enable: "false"` in `argocd-cm` if you don't use Jsonnet, and drop `--enable-helm` from `kustomize.buildOptions`; both are complete workarounds for their bug. For the Kustomize ref bug, the only stopgap is pinning Applications to Kustomize older than 5.0, and the AppProject hook bypass has no configuration fix.
3. Tighten RBAC: who can push to repos behind restricted AppProjects, who can delete Applications, who can add or edit repositories, and who holds Application `get`.
4. If untrusted users had any of these paths, rotate the credentials the repo-server can read.

## How to tell if you were hit

Grep tracked repositories for kustomizations that use `helmGlobals`/`configHome` or remote refs whose `ref`/`version` starts with `-` or uses `file://`. Also grep for `.jsonnet` files that import absolute or `../` paths. Search for resources annotated `[argocd.argoproj.io/hook](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-waves/): PreDelete` or `PostDelete` that target namespaces or kinds the project forbids, and list recent `ClusterRoleBinding` objects (`kubectl get clusterrolebindings --sort-by=.metadata.creationTimestamp`). Review repository and credential-template Secrets for unexpected `proxy` values, and check API server logs for `manifestsWithFiles` calls from unexpected users.

## Timeline

- Oct 6, 2026 — Argo CD 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2 are released.
- Oct 7, 2026 — The project publishes eight advisories, four of them critical.
- Oct 13, 2026 — The CVE-2026-77459 record is published, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-77459) lists it the same day.
- Oct 15, 2026 — [GHSA-fmxq-cgp8-87wp](https://github.com/advisories/GHSA-fmxq-cgp8-87wp) enters the GitHub Advisory Database.
- Oct 20, 2026 — CVE records for CVE-2026-113708, -113709 and -113672 are published.

## Sources

1. [Argo CD — GHSA-fmxq-cgp8-87wp: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp)
2. [Argo CD — GHSA-9v9p-x54c-58gc: A Kustomize remote ref can run commands in the repo-server](https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc)
3. [Argo CD — GHSA-fw5c-w8rc-j7fx: A Kustomize Helm config home can run commands in the repo-server](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)
4. [Argo CD — GHSA-m3vr-7329-44ww: A Jsonnet import can read files from the repo-server](https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww)
5. [Argo CD — GHSA-j6cw-g6p4-7hch: Command injection via a repository proxy URL on SSH Git repositories](https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch)
6. [Argo CD — v3.3.15 release notes](https://github.com/argoproj/argo-cd/releases/tag/v3.3.15)
7. [CVE record — CVE-2026-77459](https://www.cve.org/CVERecord?id=CVE-2026-77459)
8. [NVD — CVE-2026-77459](https://nvd.nist.gov/vuln/detail/CVE-2026-77459)
9. [Argo CD docs — Sync phases, waves and resource hooks](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-waves/)
10. [GitHub Advisory Database — GHSA-fmxq-cgp8-87wp](https://github.com/advisories/GHSA-fmxq-cgp8-87wp)

---
Source page: https://erroneo.us/security/briefs/argo-cd-october-2026-repo-server-rce-appproject-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt