Security1 hOctober 13, 2026, 16:41

Argo CD patches four CVSS 9.9 flaws in repo-server and AppProject

The Argo CD project released patches v3.5.4, v3.4.10, v3.3.15 and v3.6.0-rc2 fixing four vulnerabilities rated CVSS 9.9. The flaws affect Kustomize, Jsonnet and an AppProject hook bypass; no exploitation in the wild has been confirmed.

DEV Community

Open source

Argo CD patches four CVSS 9.9 flaws in repo-server and AppProject

CVE-2026-77459: AppProject check skipped for PreDelete and PostDelete hooks
Kustomize Helm config home can run a plugin from inside the repository
Jsonnet file read exposes any path the repo-server can read, including tokens
All supported releases affected; 2.x and 3.0–3.2 will not be patched

#ArgoCD#Kustomize#Jsonnet

Argo CD 3.5 adds internal mTLS and signed-commit verification

Security

GitLab patches CVE-2026-90970 in AI Gateway rated CVSS 9.9

Security

UTMStack Cluster hit by 7 CVEs, peak CVSS 9.9 missing auth on STOMP WebSocket

Security

Argo CD patches four CVSS 9.9 flaws in repo-server and AppProject

Argo CD 3.5 adds internal mTLS and signed-commit verification

GitLab patches CVE-2026-90970 in AI Gateway rated CVSS 9.9

UTMStack Cluster hit by 7 CVEs, peak CVSS 9.9 missing auth on STOMP WebSocket

CVE-2026-92948: vm2 sandbox escape via node:test rated 9.9