CVE-2026-77459
Description
A flaw was found in argo-cd. PreDelete and PostDelete resource hooks bypass AppProject security policies that restrict destination servers, namespaces, and permitted resource types. An authenticated attacker with write access to a linked Git repository can commit malicious delete hooks, which Argo CD executes using the controller's elevated cluster credentials upon application deletion. This flaw allows an attacker to achieve privilege escalation by creating unauthorized resources across restricted namespaces or the entire cluster.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
