Security-Patch on CuraDevOps

Argo CD v3.4.8: CVE patches and auto-sync bug fix

Mon, 31 Aug 2026 18:45:38 +0000

Platform/SRE — Plan: Teams running Argo CD should schedule an upgrade to 3.4.8 this sprint: it patches three CVEs in UI JS dependencies (none KEV-listed, EPSS ≤ 0.01) and fixes an auto-sync regression that silently skips syncs when a newer commit arrives during an active sync. No hard deadline, but the sync bug is a silent correctness risk on busy clusters.
CI/CD — Skip
Leader — Skip
Signals: Argo CD 3.4 supported · CVE-2026-14257 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-49978 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-59869 — CISA KEV: not listed, EPSS 0.01

Tue, 18 Aug 2026 11:17:30 +0000

Platform/SRE — Plan: If running a self-managed GitLab instance, upgrade to the patched version in your release line; no public PoC or KEV listing is confirmed from the title alone, so this is urgent-but-scheduled rather than emergency.
CI/CD — Act: GitLab CI users on self-managed instances should upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 promptly — a critical patch to the CI/CD platform itself can directly break or compromise pipelines and should be treated as an outage-level priority.
Leader — Skip
Signals: major release (19.0)

Mon, 27 Jul 2026 14:28:32 +0000

Platform/SRE — Plan: Platform engineers running OpenTofu should upgrade to 1.12.5 to address the ECH handshake privacy leak (server hostname de-anonymization via passive observation) and the implicit-move provider state bug; no KEV listing or active exploitation reported, so no hard deadline, but this should be included in the next IaC toolchain update cycle.
CI/CD — Skip
Leader — Skip