Security1 hOctober 22, 2026, 19:00

Argo CD: four critical flaws, three without CVE IDs

On October 7, 2026, the Argo CD project published six security advisories, four of them rated CVSS 9.9. Three of the critical vulnerabilities still have no CVE number, and an unauthenticated RCE in the Repo Server has remained unpatched since July 2026.

DEV Community

Open source

Argo CD: four critical flaws, three without CVE IDs

Six advisories from October 7 are fixed in v3.3.15, v3.4.10, v3.5.4 and v3.6.0-rc2
Only CVE-2026-55797 (CVSS 8.8) is in NVD; three critical flaws have no CVE
The Repo Server flaw has allowed unauthenticated RCE since July 2026
Branches 2.x and 3.0–3.2 are out of support and will not be patched

#ArgoCD#Kubernetes

Argo CD fixes four CVSS 9.9 flaws in repo-server and AppProject

Software

Argo CD 3.5.3 lets app-of-apps wave pass a child with a missing resource

Software

Argo CD 3.5 adds internal mTLS and signed-commit verification

Security

Argo CD: four critical flaws, three without CVE IDs

Argo CD fixes four CVSS 9.9 flaws in repo-server and AppProject

Argo CD 3.5.3 lets app-of-apps wave pass a child with a missing resource

Argo CD 3.5 adds internal mTLS and signed-commit verification

Critical Kubernetes zero-day exposes global cloud infrastructure