Plan
active
Argo CD v3.4.10: multiple CRITICAL security fixes in repo-server
- Platform/SRE — Plan: Four CRITICAL CVEs patched — including RCE via Kustomize remote refs and Jsonnet imports in the repo-server, plus an AppProject restriction bypass — with no KEV listing or confirmed active exploitation. Schedule upgrade to v3.4.10 this sprint; none of the exploits have a forced deadline, but CRITICAL severity in a GitOps control plane warrants prompt action.
- CI/CD — Plan: The HIGH-severity command injection via SSH Git repository proxy URL (CVE-2026-55797) and the AppProject hook bypass directly affect the deploy path managed through Argo CD. No active exploitation is confirmed, but teams running Argo CD for GitOps deployments should plan an upgrade to v3.4.10 before end of current sprint.
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.