Argo CD: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks
Summary
Argo CD does not apply AppProject destination and resource allow/deny checks to PostDelete (and, in 3.3 and later, PreDelete) resource hooks. A user with write access to an Application's Git repository can commit a delete hook that targets a forbidden namespace, server, or resource type. When the Application is deleted, the application controller creates that resource with its destination-cluster credentials, which can include cluster-scoped resources and persistent hook objects. Exploitation requires write access to the Git repository and the ability to delete the Application; the Argo CD web UI or API is not the entry point.
Affected
- Argo CD 2.10.0 up to 2.14.21
- Argo CD 3.0.0 up to 3.3.14
- Argo CD 3.4.0 up to 3.4.9
- Argo CD 3.5.0 up to 3.5.3
- Argo CD 3.6.0-rc1
- Argo CD 2.9.22 and earlier are not affected according to the vendor advisory.
Fixed in
- Argo CD 3.3.15
- Argo CD 3.4.10
- Argo CD 3.5.4
- Argo CD 3.6.0-rc2
- Newer patch releases exist; use the latest patch release of your branch and check its release notes.
Workaround
- Per the vendor advisory, no configuration setting closes the gap while delete hooks are in use.
- Restrict who can push to Application source repositories (branch protection, mandatory review of changes to deployment paths).
- Review repositories for PreDelete and PostDelete hook manifests.
- Limit who can delete Applications.
- Limit the cluster RBAC of the application controller, since the reachable impact is bounded by it.
Exploitation
- No confirmed exploitation in the wild has been reported.
- No public proof-of-concept has been reported.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Upgrade Argo CD to a patched release (3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2 or later). Versions 2.x and 3.0 to 3.2 should be checked against the official support policy and moved to a patched 3.3+ release.
- Restrict write access to Application Git repositories and enforce review of changes.
- Review existing repositories for delete hook manifests and check for unexpected resources in forbidden namespaces or cluster-scoped resources.
- Limit who can delete Applications and reduce the controller's cluster permissions.
- Monitor for changes to Application deletions and for resources created by hook Jobs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fmxq-cgp8-87wp github.com
- Argo CD release v3.3.15 github.com
- Argo CD release v3.4.10 github.com
- Argo CD release v3.5.4 github.com
- Argo CD release v3.6.0-rc2 github.com
- Fix commit 1149cdc (release-3.3) github.com
- OSV entry BIT-argo-cd-2026-77459 osv.dev
- Go vulndb issue 6784 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:25.
Original description (NVD)
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
NVD references (9)
- https://github.com/argoproj/argo-cd/commit/1149cdc6e932208c4402183cc3d7b7485239940c
- https://github.com/argoproj/argo-cd/commit/4bc8085b0a6d2296b849539d3d09fc7be7a4a511
- https://github.com/argoproj/argo-cd/commit/7f0a05834b05103d69d7c150e1ee36541b314696
- https://github.com/argoproj/argo-cd/commit/d5dd7019ee65be8895133fe4df554e28074242c4
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.15
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.10
- https://github.com/argoproj/argo-cd/releases/tag/v3.5.4
- https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.