External risk intelligence

Argo CD PostDelete Hooks Bypass Project Security Checks

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-77459

Argo CD is a Kubernetes-based GitOps tool typically deployed within internal network environments or behind management proxies. While the service is network-reachable and managed by authenticated users, it is generally not exposed directly to the public internet in standard deployments. Exploitation requires authenticated access to the Git repository or the application controller, limiting exposure primarily to internal users or CI/CD pipelines.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Argo CD allows a user with repository write access to bypass security checks when deleting applications, potentially enabling the creation of unauthorized resources within your Kubernetes environment. The core issue lies in how certain delete operations do not adhere to the same project authorization rules as regular deployments.

An authorized user can bypass deletion restrictions.
This allows unauthorized resource creation with controller privileges.
Confirming exposure is the primary leadership concern.

Attack Path

How an attacker could exploit the issue

An attacker with write access to an Argo CD Application's Git repository can bypass security checks by committing a malicious PostDelete resource hook. When the Argo CD Application is deleted, this hook is executed without the usual authorization and destination checks. This allows the application controller to create or manipulate resources on the cluster using its own credentials, potentially leading to the compromise of cluster-scoped resources, unauthorized namespaces, or the creation of persistent hook objects.

Requires write access to Git repository.
Triggered by deleting an Argo CD Application.
Risk of unauthorized resource creation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, Argo CD's PostDelete resource hooks could bypass authorization checks, allowing a malicious actor with write access to an Application's Git repository to execute actions within forbidden namespaces, against disallowed resource types, or on unauthorized clusters using the application-controller's credentials. The potential impact is limited by the controller's cluster access.

Compromise of controller credentials and cluster resources.
Hook execution bypasses project authorization checks.
Unauthorized resource creation or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Argo CD tool, used for Kubernetes GitOps deployments, presents a critical risk due to a vulnerability in its PostDelete resource hooks. Technical leaders, security teams, and system owners must first identify all instances of Argo CD, determine their exposure and business criticality, and then locate the accountable owner for each instance. Remediation planning should prioritize high-risk deployments, involving coordination with platform or application teams to manage maintenance windows and vendor engagement if necessary.

Platform or application teams own the issue.
Verify Argo CD reachability and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Argo CD and what is its primary function?

Argo CD is a GitOps delivery tool designed to automate application deployments on Kubernetes. It works by continuously monitoring a Git repository for infrastructure definitions and ensuring the live state of your cluster matches the desired configuration stored in that repository.

What is the nature of the vulnerability in CVE-2026-77459?

This is a security weakness categorized as CWE-863, or Incorrect Authorization. In affected versions of Argo CD, the system fails to apply project-level permission checks when executing 'PostDelete' resource hooks. This allows actions that should be restricted to occur without standard authorization validation.

How is this vulnerability triggered?

An attacker with write access to a managed Git repository can commit a malicious PostDelete hook. The flaw triggers only when the corresponding Argo CD Application is deleted. Importantly, other synchronization hooks like PreSync, Sync, or PostSync remain protected by normal authorization checks and are not impacted.

Who is most at risk from this Argo CD vulnerability?

Teams managing Argo CD instances are affected if users with repository access are untrusted. According to Halo Surface Signal, while Argo CD is network-reachable, it is usually deployed internally or behind proxies rather than on the public internet. The primary threat comes from users already authorized to modify Git repositories.

How should I respond to this threat?

First, identify all Argo CD instances in your environment and determine their business criticality. Coordinate with your platform teams to plan an update to one of the patched versions—3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2—during a scheduled maintenance window. Prioritize patching instances that are accessible to a wider range of users or those managing sensitive cluster environments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.