CVE-2026-77459

Executive Summary

CVE-2026-77459 is an authorization bypass vulnerability in Argo CD, a declarative GitOps continuous delivery tool for Kubernetes. In affected versions (2.10.0 through 3.6.0-rc1), the application-controller creates PostDelete resource hooks without enforcing the AppProject destination and resource authorization checks that normally govern synchronization, including cluster-scoped and namespaced allow/deny lists. A user able to write to an Application's Git repository can commit a malicious delete hook targeting a forbidden destination (namespace, server, group, kind, or resource name); when the Application is deleted, the controller materializes that resource using its own destination-cluster credentials. The impact is bounded only by the controller's cluster access and can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. With a CVSS base score of 9.9, this represents critical risk to any environment where untrusted or partially trusted contributors can commit to a GitOps-managed repository.

Technical Analysis

The vulnerability class is CWE-863 (Incorrect Authorization), specifically an inconsistency in the enforcement of AppProject boundary controls across different phases of an Argo CD sync operation.

Argo CD applies AppProject restrictions during ordinary synchronization. These restrictions include:

• Destination authorization (which Kubernetes API server and namespace a target resource may be deployed to).
• Cluster-scoped resource allow/deny lists.
• Namespaced resource allow/deny lists (by group, kind, and resource name).

The flaw is that these same checks are not applied when the application-controller processes PostDelete hooks. PostDelete hooks are Argo CD resource hooks intended to run after a resource or Application is deleted. Because the authorization path for PostDelete hook creation diverges from the normal synchronization path, the controller will instantiate the hook resource using its destination-cluster credentials without first validating that the hook's target destination falls within the AppProject's permitted scope.

This is a "path divergence" or "missing check on an alternate code path" pattern. The controller possesses highly privileged credentials by design, since it must be able to create arbitrary manifests on destination clusters. The AppProject allow/deny lists are the primary mechanism that constrains what a given Application (and therefore any user with repository write access to that Application's source) can cause the controller to do. Removing that constraint for one hook type creates a privilege escalation primitive from "Git repository write" to "controller-privileged resource creation."

Critically, the omitted checks explicitly include cluster-scoped and namespaced resource allow/deny lists. This means the flaw is not merely a namespace boundary violation but can also bypass cluster-scoped protections—the highest-privilege class of Kubernetes objects. The NVD description states that pre-existing hooks (PreSync, Sync, PostSync, SyncFail) continue to enforce the normal project checks, confirming that the defect is specific to PostDelete.

The precondition is write access to the Application's Git repository. In GitOps models, repository write access is often granted to a broader set of contributors (developers, CI service accounts, automation bots) than those with direct cluster credentials, making this a realistic privilege boundary to cross.

Exploitation Scenarios

No public PoC is available for CVE-2026-77459; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies an Argo CD installation (typically a public or internal UI/API endpoint) and determines which Applications are under GitOps management. They assess whether they have or can obtain write access to the Git repository backing a target Application. If so, they examine the associated AppProject definition to learn which destinations, cluster-scoped resources, namespaced resources, and names are disallowed—these are the very categories the missing check fails to enforce.

2. Triggering the Flaw Class. The attacker commits a manifest to the Application's Git repository that is annotated as a PostDelete resource hook, with a destination (namespace, server, group, kind, resource name) chosen specifically to violate the AppProject's allow/deny lists. Because PostDelete hook creation does not apply the AppProject destination and resource authorization checks, the malicious manifest is accepted into the Application's desired state on the hook path.

3. Payload / Execution. The attacker then causes deletion of the Application (or of the resource the hook is attached to, causing the PostDelete hook to fire). During deletion processing, the application-controller creates the hook resource using its destination-cluster credentials. The resource is created at the forbidden destination—e.g., a namespace the attacker cannot access, a resource kind on the deny list, or a cluster-scoped object. The NVD description notes the hook may be a Job capable of creating secondary objects.

4. Post-Exploitation Impact. Because creation is performed with controller credentials, the attacker achieves effects beyond their nominal authorization: objects in disallowed namespaces, cluster-scoped resources, and persistent hook objects that survive beyond the deletion event. In practice, an attacker who can craft a hook Job gains the controller's cluster access as a foothold for broader compromise, subject to whatever the controller's own service account can do. The reachable impact is explicitly bounded by the controller's cluster access.

Impact Assessment

CVSS 3.1 base score: 9.9 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

• Attack Vector (N — Network): The GitOps repository and/or Argo CD API are reachable over the network.
• Attack Complexity (L — Low): No specialized conditions; the attacker only requires the ability to commit a hook manifest and trigger Application deletion.
• Privileges Required (L — Low): Effective precondition is write access to the Application's Git repository.
• User Interaction (N — None): Application deletion can be triggered by the attacker or by normal operational events; no victim interaction is required for the flaw to manifest.
• Scope (C — Changed): The controller acts with credentials and privileges beyond those of the attacker, crossing an authorization boundary—so scope is changed.
• Confidentiality / Integrity / Availability (H — High): Arbitrary resource creation with controller privileges can expose secrets, alter cluster state, and disrupt workloads.

Blast radius: Any Kubernetes cluster managed by an affected Argo CD version where AppProject restrictions are relied upon to bound what repository-writing users can cause to be deployed. This includes cluster-scoped resources and disallowed namespaces—the most sensitive targets. Multi-tenant GitOps platforms where developers have repository write access but not cluster access face the highest exposure, since this CVE collapses that separation. Organizations should treat AppProject deny lists as non-enforcing for PostDelete hooks until patched.

Detection Guidance

Sigma Rule

title: Argo CD PostDelete Hook Authorization Bypass Attempt
id: 7f3c9a12-4e8b-4d21-9c77-2b1e6f8a0d34
status: experimental
description: Detects creation or deletion of Argo CD Applications whose manifests include PostDelete resource hooks, a pattern abused in CVE-2026-77459 to bypass AppProject authorization checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77459
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: kubernetes
  service: audit
detection:
  selection_verb:
    verb:
      - create
      - delete
  selection_resource:
    objectRef.resource:
      - applications
      - applications.argoproj.io
  selection_hook:
    requestObject.spec.syncPolicy|contains: "PostDelete"
  condition: selection_verb and selection_resource and selection_hook
falsepositives:
  - Legitimate PostDelete hooks created by administrators with full AppProject permissions
level: high

YARA Rule

rule CVE_2026_77459_ArgoCD_PostDelete_Hook
{
    meta:
        description = "Detects Argo CD manifest content declaring a PostDelete hook, relevant to CVE-2026-77459 authorization bypass"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77459"
        date = "2026-01-01"
        severity = "high"

    strings:
        $hook_annot = "argocd.argoproj.io/hook" ascii wide
        $postdelete = "PostDelete" ascii wide
        $kind = "kind:" ascii wide
        $apiVersion = "apiVersion:" ascii wide

    condition:
        $hook_annot and $postdelete and $kind and $apiVersion
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77459 Argo CD PostDelete Hook Manipulation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/applications"; http.request_body; content:"PostDelete"; nocase; reference:cve,2026-77459; classtype:attempted-admin; sid:9007745; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.module == "kubernetes" and event.action == "create" and
     kubernetes.audit.objectRef.resource : "applications"]
  [process where event.module == "kubernetes" and event.action in ("create", "delete") and
     kubernetes.audit.requestObject.spec.source : * and
     process.args : "*PostDelete*"]

Splunk SPL Query

index=kubernetes sourcetype="kube:apiserver:audit"
| search objectRef.resource=applications verb=create OR verb=delete
| where match(requestObject, "(?i)PostDelete")
| stats count values(user.username) as users values(objectRef.name) as apps by src_ip, verb
| where count > 0

Wazuh OSSEC Rule

<group name="argocd,cve-2026-77459,">
  <rule id="877459" level="12">
    <decoded_as>json</decoded_as>
    <field name="objectRef.resource">applications</field>
    <field name="verb">create|delete</field>
    <regex path="requestObject">PostDelete</regex>
    <description>CVE-2026-77459: Argo CD PostDelete hook authorization bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Restrict Git repository write access to Argo CD Application source repositories to the smallest possible set of trusted identities. This vulnerability's precondition is repository write access, so tightening that boundary directly reduces exposure.
• Where feasible, disable or avoid PostDelete hooks in Application manifests until patched; audit existing Applications for PostDelete hooks and remove any that are not strictly required.
• Enforce least privilege on the application-controller's cluster access. The reachable impact is bounded by the controller's credentials, so reducing those credentials reduces blast radius.
• Monitor Kubernetes audit logs for creation of Application-associated resources at destinations that violate AppProject allow/deny lists.

2) Patch / upgrade steps.

• Per the NVD description, the issue is fixed in Argo CD 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. Upgrade to the appropriate fixed release for your minor version line.
• Note: no vendor patch reference, commit, or advisory has been confirmed by any tracked source (patch confidence 0/4). Verify the availability and authenticity of these releases directly against the official Argo CD project before deploying.
• After upgrading, re-audit AppProject allow/deny configurations and Application manifests to confirm no unauthorized PostDelete hooks remain.

3) Long-term hardening.

• Treat Git repository write access to GitOps source as a privileged operation; enforce mandatory review and signed commits for Changes to Application manifests.
• Adopt least-privilege AppProject definitions and avoid broad cluster-scoped grants.
• Add CI policy checks (e.g., manifest linting) that flag PostDelete hooks and destination values outside AppProject boundaries.
• Continuously monitor controller service account permissions and alert on creation of cluster-scoped or out-of-namespace resources attributed to the controller.

References

• NVD — CVE-2026-77459: https://nvd.nist.gov/vuln/detail/CVE-2026-77459
• Argo CD project documentation (resource hooks and AppProject configuration): https://argo-cd.readthedocs.io/
• Argo CD releases page (verify fixed versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2): https://github.com/argoproj/argo-cd/releases
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA KEV catalog (CVE not listed as of reporting; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit code, Nuclei template, or public PoC is available. No threat actor campaign or in-the-wild exploitation has been reported for this CVE.