Argo CD: PostDelete hooks skip AppProject destination and resource allow/deny checks

Impact

Argo CD creates PostDelete hook resources without the AppProject destination and resource authorization checks it applies during normal sync, so the allow/deny lists for cluster-scoped and namespaced kinds are not enforced on that path. Anyone who can commit to an Application's Git repository can add a delete hook targeting a namespace, cluster, group, kind or resource name the project forbids; deleting the Application then makes the application-controller create it using the destination cluster's credentials. On a shared GPU cluster where Argo CD holds broad cluster-admin-like access, that is a path from repository write to cluster-scoped object creation - a hook Job can in turn create further objects, so a tenant confined to one namespace by AppProject policy can reach outside it. PreSync, Sync, PostSync and SyncFail hooks are unaffected; only PostDelete bypasses the checks.

Who can reach it

A user with write access to an Application's Git repository (no Argo CD API privileges needed beyond whatever triggers the Application deletion). Reachable impact is bounded by the application-controller's own RBAC on the destination cluster.

What to do

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2. This is a control-plane component upgrade - rolling the application-controller and repo-server deployments, with no GPU node disruption; in-flight syncs pause briefly. Until then, review PostDelete hooks in managed repositories and tighten the controller's cluster RBAC so the blast radius matches the AppProject intent.

References

Related entries

• KEDA: namespace admin can exfiltrate the operator ServiceAccount token to a tenant-controlled Vault addressCVE-2026-77524 · KEDA (TriggerAuthentication hashiCorpVault provider)Critical
• Helm: Improper certificate validation allows unauthorized clients to connect to TillerCVE-2019-1010275 · HelmCritical
• Docker / moby: Code injection into `docker cp` via nsswitch loading a library from the container chrootCVE-2019-14271 · Docker / mobyCritical
• Helm: Malicious chart includes sensitive host content such as /etc/passwd, or triggers DoS, when loadedCVE-2019-18658 · HelmCritical
• Envoy: HTTP/2 request writes to the heap outside request buffers when the upstream is HTTP/1CVE-2019-18801 · EnvoyCritical
• Envoy: Header whitespace handling enables request smuggling and authorization bypassCVE-2019-18802 · EnvoyCritical