Security1 hOctober 16, 2026, 04:20

Argo CD fixes four CVSS 9.9 flaws in repo-server and AppProject

Argo CD patched four CVSS 9.9 vulnerabilities in October 2026. Three are repository-content issues in argocd-repo-server, while CVE-2026-77459 is an AppProject enforcement gap on PreDelete and PostDelete hooks. No confirmed exploitation or public proof-of-concept has been reported.

DEV Community

Open source

Fixes shipped in v3.5.4, v3.4.10, v3.3.15 and v3.6.0-rc2
Branches 2.x and 3.0–3.2 will not be patched
CVE-2026-77459 needs repo write access and Application delete rights
Interim mitigations: disable Helm in Kustomize and jsonnet.enable

#ArgoCD

Argo CD 3.5 adds internal mTLS and signed-commit verification

Security

GitLab patches CVE-2026-90970 in AI Gateway rated CVSS 9.9

Security

UTMStack Cluster hit by 7 CVEs, peak CVSS 9.9 missing auth on STOMP WebSocket

Security

Argo CD fixes four CVSS 9.9 flaws in repo-server and AppProject

Argo CD 3.5 adds internal mTLS and signed-commit verification

GitLab patches CVE-2026-90970 in AI Gateway rated CVSS 9.9

UTMStack Cluster hit by 7 CVEs, peak CVSS 9.9 missing auth on STOMP WebSocket

CISA: Monta EV charging platform has four flaws, worst rated CVSS 9.4