StackRadar

CVE-2026-77459

Critical

Advisory

Published 15 Oct 2026In the index since 16 Oct 2026
Severity
Critical
worst across findings
CVSS
9.9
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 18,219 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 3
affected packages

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Carried by container images the latest versions of 26 of 18,219 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
github.com/argoproj/argo-cd/v3golangv3.0.3, v3.0.5, v3.1.1, v3.2.12+6 more3.3.15, 3.5.411
github.com/argoproj/argo-cd/v2golangv2.10.7, v2.11.5, v2.13.3, v2.14.9+2 moreno fix listed10
github.com/argoproj/argo-cdgolangv1.5.8no fix listed1
OSV records
GHSA-fmxq-cgp8-87wpGO-2026-6784
Also known as
BIT-argo-cd-2026-77459

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.3.15

Open the chart page →

7,550
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

119,903
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.3.15

Open the chart page →

1,517
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

2,325
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

2,325
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.3.15

Open the chart page →

15,416
alustan-helmalustan-helm1.0.01 of 1See more

alustan-helm alustan-helm 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
alustan/install-argocd:1.0.0c16c34f46ad3
github.com/argoproj/argo-cd/v2@v2.11.5
no fix listed

Open the chart page →

2,617
fargocdappscodeVerified publisher2026.9.181 of 1See more

fargocd appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15

Open the chart page →

822
fargocd-managerappscodeVerified publisher2026.9.181 of 1See more

fargocd-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15

Open the chart page →

822
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

10,480
capsule-argo-addoncapsule-argo-addonVerified publisher0.8.01 of 2See more

capsule-argo-addon capsule-argo-addon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.8.064b8c5389b33
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4

Open the chart page →

2,007
argo-cdcluster-deploy0.3.32 of 3See more

argo-cd cluster-deploy 0.3.3

2 of the 3 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
github.com/argoproj/argo-cd/v3@v3.5.3+dirty
3.5.4
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4

Open the chart page →

4,097
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

217,278
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

217,278
devtron-operatordevtron-labs0.23.31 of 11See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

119,903
kubecheckskubechecks3.1.01 of 1See more

kubechecks kubechecks 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/zapier/kubechecks:latest65780f7c0ae9
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4

Open the chart page →

951
argomicroslacVerified publisher0.1.01 of 4See more

argo microslac 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.10.783c86003b781
github.com/argoproj/argo-cd/v2@v2.10.7
no fix listed

Open the chart page →

13,139
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed

Open the chart page →

1,988
argocd-agent-addonocm-helm-chartsVerified publisher0.30.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.30.0

1 of the 2 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15

Open the chart page →

1,331
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.15

Open the chart page →

899
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

76,488
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
github.com/argoproj/argo-cd/v3@v3.5.2+dirty
3.5.4

Open the chart page →

2,676
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

217,278
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

119,903
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

3,399
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2026-77459.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed

Open the chart page →

8,079

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
2
alustan/install-argocd:1.0.0c16c34f46ad3
github.com/argoproj/argo-cd/v2@v2.11.5
no fix listed
1
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed
1
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
1
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.15
1
ghcr.io/peak-scale/capsule-argo-addon:0.8.064b8c5389b33
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4
1
ghcr.io/zapier/kubechecks:latest65780f7c0ae9
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4
1
quay.io/argoproj/argocd:v2.10.783c86003b781
github.com/argoproj/argo-cd/v2@v2.10.7
no fix listed
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.3.15
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.3.15
1
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
github.com/argoproj/argo-cd/v3@v3.5.3+dirty
3.5.4
1
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.3.15
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
github.com/argoproj/argo-cd/v3@v3.5.2+dirty
3.5.4
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.