Vulnpedia
← Search CVEs

CVE-2026-77459

CRITICAL 9.9

Published 2026-10-13 · Last modified 2026-10-14

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

ELEVATED IMPACT

Severe if exploited (CVSS 9.9), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 42nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.9CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Argoproj

Products Argo Cd

Weakness (CWE)

  • CWE-863: : Incorrect Authorization

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/argoproj/argo-cd/v2 Go

    pkg:golang/github.com/argoproj/argo-cd/v2

    SEMVER range
    • Introduced version (included): 2.10.0
    • Last affected version (included): 2.14.21
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fmxq-cgp8-87wp/GHSA-fmxq-cgp8-87wp.json"
  }
}
    GitHub Advisory Database · GHSA-fmxq-cgp8-87wp · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.0.0
    • Fixed boundary (excluded): 3.3.15
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fmxq-cgp8-87wp/GHSA-fmxq-cgp8-87wp.json"
  }
}
    GitHub Advisory Database · GHSA-fmxq-cgp8-87wp · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.4.0
    • Fixed boundary (excluded): 3.4.10
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fmxq-cgp8-87wp/GHSA-fmxq-cgp8-87wp.json"
  }
}
    GitHub Advisory Database · GHSA-fmxq-cgp8-87wp · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.5.0
    • Fixed boundary (excluded): 3.5.4
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fmxq-cgp8-87wp/GHSA-fmxq-cgp8-87wp.json"
  }
}
    GitHub Advisory Database · GHSA-fmxq-cgp8-87wp · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.6.0-rc1
    • Fixed boundary (excluded): 3.6.0-rc2
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fmxq-cgp8-87wp/GHSA-fmxq-cgp8-87wp.json"
  }
}
    GitHub Advisory Database · GHSA-fmxq-cgp8-87wp · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd Go

    pkg:golang/github.com/argoproj/argo-cd

    SEMVER range
    • All earlier versions (introduced 0)
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6784.json"
  }
}
    Go Vulnerability Database · GO-2026-6784 · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v2 Go

    pkg:golang/github.com/argoproj/argo-cd/v2

    SEMVER range
    • Introduced version (included): 2.10.0
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6784.json"
  }
}
    Go Vulnerability Database · GO-2026-6784 · Updated 2026-10-20T11:25:50.628228133Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.0.0
    • Fixed boundary (excluded): 3.3.15
    • Introduced version (included): 3.4.0
    • Fixed boundary (excluded): 3.4.10
    • Introduced version (included): 3.5.0
    • Fixed boundary (excluded): 3.5.4
    • Introduced version (included): 3.6.0-rc1
    • Fixed boundary (excluded): 3.6.0-rc2
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6784.json"
  }
}
    Go Vulnerability Database · GO-2026-6784 · Updated 2026-10-20T11:25:50.628228133Z

Vendor product assessments

Showing 32 of 140 vendor product statements; 108 omitted. Read the full vendor advisory.

  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:29b6164d34787ee1b4881d16d6efadbca82cd4909eb8f53126d405fffa4a2bd1_amd64 as a component of Red Hat OpenShift GitOps 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A29b6164d34787ee1b4881d16d6efadbca82cd4909eb8f53126d405fffa4a2bd1?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791184378

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5580f88c8f896f9a94bada7d2053eb4216be0f8b060d08eacdbb0ab49e859a07_arm64 as a component of Red Hat OpenShift GitOps 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A5580f88c8f896f9a94bada7d2053eb4216be0f8b060d08eacdbb0ab49e859a07?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791184378

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5e2815998b123ef256df13c8256e9a68eb174ad31d12728a3366f73212030f6d_s390x as a component of Red Hat OpenShift GitOps 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A5e2815998b123ef256df13c8256e9a68eb174ad31d12728a3366f73212030f6d?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791184378

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:7cc9d10b10bcbd007e01cf0473ad12843adff1a47abe36ac32fdac367d4e7a14_ppc64le as a component of Red Hat OpenShift GitOps 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A7cc9d10b10bcbd007e01cf0473ad12843adff1a47abe36ac32fdac367d4e7a14?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791184378

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:49cb6fac7a1ee4c44053822a447b2c57abf5a0e195076e2f1208af1eff26166c_amd64 as a component of Red Hat OpenShift GitOps 1.21 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A49cb6fac7a1ee4c44053822a447b2c57abf5a0e195076e2f1208af1eff26166c?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791252092

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f32c3010f66d945f41d7289e79022f47bcadb4b81429a4f401ce2bc6ac64f6cb_s390x as a component of Red Hat OpenShift GitOps 1.21 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3Af32c3010f66d945f41d7289e79022f47bcadb4b81429a4f401ce2bc6ac64f6cb?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791252092

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f53638b4470adcd01a4d023e82aa05a719deafed146c7a169b606e089307f231_ppc64le as a component of Red Hat OpenShift GitOps 1.21 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3Af53638b4470adcd01a4d023e82aa05a719deafed146c7a169b606e089307f231?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791252092

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:ffa4d96e59265f09ebb23f4fb3d607ffb58abd5a12ec9220c5728a7b59ef81c5_arm64 as a component of Red Hat OpenShift GitOps 1.21 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3Affa4d96e59265f09ebb23f4fb3d607ffb58abd5a12ec9220c5728a7b59ef81c5?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791252092

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:077f0a2f82756ab38c72ebd0140cfb293f8067cebb9427d5cf5c85f683c7fef5_ppc64le as a component of Red Hat OpenShift GitOps 1.22 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A077f0a2f82756ab38c72ebd0140cfb293f8067cebb9427d5cf5c85f683c7fef5?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791192797

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:0d4be984b53ece8691851713ef4c3101ca072c639ec0aa3b890d7da48291e0ab_s390x as a component of Red Hat OpenShift GitOps 1.22 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3A0d4be984b53ece8691851713ef4c3101ca072c639ec0aa3b890d7da48291e0ab?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791192797

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b641491d57a12089873cf5a0339c023ff8ad3abf4547dfa8f815d4839b68626f_arm64 as a component of Red Hat OpenShift GitOps 1.22 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3Ab641491d57a12089873cf5a0339c023ff8ad3abf4547dfa8f815d4839b68626f?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791192797

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b70caabf383cedf5816ac6fbecbb651dc86f9206838c929b52cc8d24a70593b7_amd64 as a component of Red Hat OpenShift GitOps 1.22 · fixed

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9@sha256%3Ab70caabf383cedf5816ac6fbecbb651dc86f9206838c929b52cc8d24a70593b7?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9&tag=1791192797

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:9219504aef129b62971960248aeab972ed8df13073b8437b11ea09f08caecbe1_s390x as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argo-rollouts-rhel9@sha256%3A9219504aef129b62971960248aeab972ed8df13073b8437b11ea09f08caecbe1?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9&tag=1791184750

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:d89b4a85b4afe0ea7b759221c32c1ff0867ce7f61cf0e2ef0e05cbdc8809aad7_ppc64le as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-agent-rhel9@sha256%3Ad89b4a85b4afe0ea7b759221c32c1ff0867ce7f61cf0e2ef0e05cbdc8809aad7?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9&tag=1791183980

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:d7751e168acc34788363659361bc257b0fe34cc33ebc691278747a899f6f2985_arm64 as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-image-updater-rhel9@sha256%3Ad7751e168acc34788363659361bc257b0fe34cc33ebc691278747a899f6f2985?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9&tag=1791183886

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:18473fe92565afb2c13427a1119e3333f885e12188bb13ae7ca52e922033b6f6_arm64 as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/dex-rhel9@sha256%3A18473fe92565afb2c13427a1119e3333f885e12188bb13ae7ca52e922033b6f6?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel9&tag=1791183962

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:deaa56809e12d2857b5b85e59033217a88bff9db4b567263781d9c371188d094_ppc64le as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9-operator@sha256%3Adeaa56809e12d2857b5b85e59033217a88bff9db4b567263781d9c371188d094?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator&tag=1791183854

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:4929d21e9a682ecef763297f7e1263157000a38f79b1939a641c9e80948247e6_ppc64le as a component of Red Hat OpenShift GitOps 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/must-gather-rhel9@sha256%3A4929d21e9a682ecef763297f7e1263157000a38f79b1939a641c9e80948247e6?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/must-gather-rhel9&tag=1791183724

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:de9c1622fbd7cc50ad66bfd32390f597a46034b9104fd78704864fda25ee0fbd_ppc64le as a component of Red Hat OpenShift GitOps 1.21 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argo-rollouts-rhel9@sha256%3Ade9c1622fbd7cc50ad66bfd32390f597a46034b9104fd78704864fda25ee0fbd?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9&tag=1791251919

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:6cd5ad5b7adddd7982c35de161ffbf5b37d33cdecc4336cc8ea9159730a0557f_arm64 as a component of Red Hat OpenShift GitOps 1.21 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-extensions-rhel9@sha256%3A6cd5ad5b7adddd7982c35de161ffbf5b37d33cdecc4336cc8ea9159730a0557f?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9&tag=1791260868

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:1340e125539783821a958146cd51a9675b633d6e9e8c2fab335eb0a39d3722ec_arm64 as a component of Red Hat OpenShift GitOps 1.21 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/console-plugin-rhel9@sha256%3A1340e125539783821a958146cd51a9675b633d6e9e8c2fab335eb0a39d3722ec?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/console-plugin-rhel9&tag=1791252544

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:cf1e7307d5fc72f28a4e976a467a4ffbc68e8d69874dca7fc7a3161933013ff6_arm64 as a component of Red Hat OpenShift GitOps 1.21 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/dex-rhel9@sha256%3Acf1e7307d5fc72f28a4e976a467a4ffbc68e8d69874dca7fc7a3161933013ff6?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel9&tag=1791253159

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:8192f82e40797322c265b73128a7a363e989d6a8e0a7d62ca7e6aff03cd22c14_arm64 as a component of Red Hat OpenShift GitOps 1.21 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9@sha256%3A8192f82e40797322c265b73128a7a363e989d6a8e0a7d62ca7e6aff03cd22c14?arch=arm64&repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9&tag=1791252015

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:373acc13d0973ccd162df093b997651d756268cdc5403afd3dd1956646ff1330_amd64 as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argo-rollouts-rhel9@sha256%3A373acc13d0973ccd162df093b997651d756268cdc5403afd3dd1956646ff1330?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9&tag=1791192808

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:50f202ab12bd2d85e36a06c93f97a39056208ec721a75e47118ad93b8e0638d0_amd64 as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-agent-rhel9@sha256%3A50f202ab12bd2d85e36a06c93f97a39056208ec721a75e47118ad93b8e0638d0?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9&tag=1791193074

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:cb9d9154e0573fcd6344123c5f61a66adce4a15f5a1a74f51464a06edb985f3b_s390x as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-image-updater-rhel9@sha256%3Acb9d9154e0573fcd6344123c5f61a66adce4a15f5a1a74f51464a06edb985f3b?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9&tag=1791193727

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:0bd6eac45f81bd48a9ff92348466fce53b3c1b1fc2d7dd1bc7f986edbbb75d63_amd64 as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/console-plugin-4-18-rhel9@sha256%3A0bd6eac45f81bd48a9ff92348466fce53b3c1b1fc2d7dd1bc7f986edbbb75d63?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9&tag=1791192530

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:8f796be0e1c86ca15e52dcb4db95833ee0cf7ea217dc9436cfe1096c4d0d5657_ppc64le as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/console-plugin-rhel9@sha256%3A8f796be0e1c86ca15e52dcb4db95833ee0cf7ea217dc9436cfe1096c4d0d5657?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/console-plugin-rhel9&tag=1791192905

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/gitops-promoter-rhel9@sha256:4cec07765db3f48acc4ec055148f605d1f9fbbcc340b437ff125cf1fab0fb4a5_amd64 as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-promoter-rhel9@sha256%3A4cec07765db3f48acc4ec055148f605d1f9fbbcc340b437ff125cf1fab0fb4a5?arch=amd64&repository_url=registry.redhat.io/openshift-gitops-1/gitops-promoter-rhel9&tag=1791193470

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:949d32f9d8fbf3476a02c5d7c21350ae47f2b4eff4e7014945ab43321ea04469_ppc64le as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9-operator@sha256%3A949d32f9d8fbf3476a02c5d7c21350ae47f2b4eff4e7014945ab43321ea04469?arch=ppc64le&repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator&tag=1791193358

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:74f4a91c358944f90519477fa9b041de610389f8de4846b2fe32eeec9f3fa9ab_s390x as a component of Red Hat OpenShift GitOps 1.22 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/must-gather-rhel9@sha256%3A74f4a91c358944f90519477fa9b041de610389f8de4846b2fe32eeec9f3fa9ab?arch=s390x&repository_url=registry.redhat.io/openshift-gitops-1/must-gather-rhel9&tag=1791192360

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00
  • openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/gitops-rhel9-operator?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator

    Red Hat · CVE-2026-77459 · Updated 2026-10-20T23:07:20+00:00

All CVSS metrics

  • CRITICAL 9.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS