Plan
active
Argo CD 3.5.4 patches multiple CRITICAL RCEs in repo-server
- Platform/SRE — Plan: Argo CD 3.5.4 fixes four CRITICAL CVEs including arbitrary command execution in the repo-server via Kustomize and Jsonnet, plus an AppProject restriction bypass. None are KEV-listed and EPSS is very low, but CRITICAL severity in a core GitOps component warrants patching this sprint — upgrade clusters to 3.5.4 promptly.
- CI/CD — Plan: The CRITICAL command-injection paths (Kustomize remote refs, Helm home, Jsonnet imports) run inside the repo-server that processes your GitOps manifests, making this directly relevant to the deploy path. Schedule an upgrade to 3.5.4; no active exploitation confirmed yet but the attack surface is in build artifact processing.
- Leader — Skip
- Signals: Argo CD 3.5 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.