Skip to content
CVE-2026-77459

Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459)

Privilege Escalation Lateral Movement Last updated:

Detects exploitation of CVE-2026-77459, an improper authorization flaw (CWE-863) in Argo CD where AppProject destination-namespace and resource-kind restrictions are not enforced for PreDelete and PostDelete resource hooks. A user with permission to manage an Application scoped to a restricted AppProject can embed a hook resource (e.g. a Job, Pod, or RBAC object annotated with argocd.argoproj.io/hook: PreDelete or PostDelete) targeting a namespace or resource kind outside the AppProject allow-list. When the Application or a resource is deleted, the argocd-application-controller applies the hook with its own cluster-wide service account, bypassing the project guardrails and enabling privilege escalation and cross-tenant resource creation. Affected: Argo CD v2.10.0-2.14.21, v3.0.0-3.3.14, v3.4.0-3.4.9, v3.5.0-3.5.3, and v3.6.0-rc1. This detection surfaces hook resources applied to out-of-project namespaces/kinds by the Argo CD application controller service account around Application delete operations.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
go
Product
github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3
Versions
>= 2.10.0, <= 2.14.21, >= 3.0.0, < 3.3.15, >= 3.4.0, < 3.4.10, >= 3.5.0, < 3.5.4, >= 3.6.0-rc1, < 3.6.0-rc2

Weakness (CWE)

CWE-863

Timeline

Disclosed
October 15, 2026

CVSS

9.9
Critical (9.0–10)
Read the write-up →

What is CVE-2026-77459 Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459)?

Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459) (CVE-2026-77459) maps to the Privilege Escalation and Lateral Movement tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459), covering the data sources and telemetry it touches: Kubernetes Audit Logs, Azure Kubernetes Service Diagnostics. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement
Microsoft Sentinel / Defender
kusto 
// Argo CD PreDelete/PostDelete hook applied to out-of-project namespace/kind (CVE-2026-77459)
// Kubernetes audit logs ingested via Azure Monitor / Diagnostic settings
let argocdController = dynamic(["system:serviceaccount:argocd:argocd-application-controller"]);
KubeAuditLogs
| where TimeGenerated > ago(1d)
| extend d = parse_json(AuditData)
| extend verb = tostring(d.verb), user = tostring(d.user.username)
| extend objKind = tostring(d.objectRef.resource), ns = tostring(d.objectRef.namespace)
| extend annotations = tostring(d.requestObject.metadata.annotations)
| where user in (argocdController)
| where verb in ("create","patch","apply")
| where annotations has "argocd.argoproj.io/hook" and (annotations has "PreDelete" or annotations has "PostDelete")
| where objKind in ("jobs","pods","rolebindings","clusterrolebindings","roles","clusterroles","serviceaccounts")
| project TimeGenerated, user, verb, objKind, ns, annotations, SourceIP = tostring(d.sourceIPs[0])

Flags the Argo CD application controller service account creating or patching PreDelete/PostDelete hook resources (especially Jobs/Pods/RBAC) in namespaces, which combined with cross-namespace targeting indicates AppProject restriction bypass.

critical severity medium confidence

Data Sources

Kubernetes Audit Logs Azure Kubernetes Service Diagnostics

Required Tables

KubeAuditLogs

False Positives

  • Legitimate PreDelete/PostDelete cleanup hooks applied within the Application's permitted destination namespace
  • GitOps-managed cleanup Jobs that an operator has intentionally scoped to the controller service account
  • Blue/green or rollout tooling that annotates resources with Argo CD hook annotations during normal syncs

Sigma rule & cross-platform mapping

The detection logic for Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459) (CVE-2026-77459) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-77459 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-77459

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-10-25 Research depth: standard
References (8)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 PreDelete hook targeting out-of-project namespace

    Expected signal: Kubernetes audit event: create jobs in namespace restricted-target with annotation argocd.argoproj.io/hook=PreDelete by the controller service account

  2. Test 2 PostDelete hook creating privileged RBAC binding

    Expected signal: Kubernetes audit event: create clusterrolebindings with annotation argocd.argoproj.io/hook=PostDelete

  3. Test 3 Hook pod in kube-system namespace

    Expected signal: Kubernetes audit event: create pods in kube-system with argocd.argoproj.io/hook annotation

Response Playbook

Triage

  1. Confirm the Argo CD server/controller version against the affected ranges (v2.10.0-2.14.21, v3.0.0-3.3.14, v3.4.0-3.4.9, v3.5.0-3.5.3, v3.6.0-rc1); if in range the environment is exploitable.
  2. Retrieve the alerting audit event and identify the hook resource kind, target namespace, and the owning Application/AppProject. Compare the target namespace and kind against the AppProject's permitted destinations and clusterResourceWhitelist/namespaceResourceWhitelist.
  3. Determine which user/SSO identity last modified the owning Application manifest or Git source, and whether that user is authorized to target the out-of-project namespace/kind directly.
  4. Inspect the hook resource body for privileged intent (RBAC bindings to cluster-admin, Jobs running privileged pods, service account token mounts) to gauge impact.

Containment

  1. Patch Argo CD to a fixed release (3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2) and restart argocd-application-controller.
  2. Immediately delete any unauthorized hook-created resources (RBAC bindings, Jobs, Pods) in out-of-project namespaces and revoke any tokens/service accounts they created.
  3. Temporarily restrict Application/AppProject edit RBAC in Argo CD for untrusted tenants and disable automated delete-phase hooks for multi-tenant projects until patched.

Evidence Collection

  1. Export the full Kubernetes audit log entries for the controller service account over the exposure window, including requestObject manifests of hook resources.
  2. Capture the Git commit history and Argo CD Application spec revisions that introduced the PreDelete/PostDelete hook annotations.
  3. Preserve controller logs (argocd-application-controller) and any created Job/Pod logs and RBAC objects before deletion.

Escalation Criteria

  • ! Escalate to incident response if hook resources created RBAC bindings granting cluster-admin or cross-tenant access, or if workloads ran in namespaces outside the AppProject allow-list.
  • ! Escalate if evidence shows the bypass was used to read secrets, create service account tokens, or pivot to other tenants' namespaces.

Investigation Guide

Forensic Artifacts

  • > Kubernetes audit log entries for system:serviceaccount:argocd:argocd-application-controller creating/patching annotated hook resources
  • > Argo CD Application spec and Git revision introducing argocd.argoproj.io/hook: PreDelete/PostDelete annotations
  • > Created RBAC objects, Jobs, Pods and any service account tokens in out-of-project namespaces

Tuning Guidance

Build an allow-list of (AppProject -> permitted destination namespaces and resource kinds) and suppress events where the hook target matches the AppProject allow-list. Focus alerting on hook resources targeting kube-system, cluster-scoped RBAC, or namespaces not declared in any AppProject destination. After patching to a fixed version, keep the hunt active but lower severity, as the controller should enforce restrictions.

Hunting Queries

Baseline which namespaces and resource kinds receive Argo CD delete-phase hooks; investigate any namespace outside expected AppProject destinations.

Hunting — KQL
kql 
KubeAuditLogs | extend d=parse_json(AuditData) | where tostring(d.user.username)=="system:serviceaccount:argocd:argocd-application-controller" | extend ann=tostring(d.requestObject.metadata.annotations), ns=tostring(d.objectRef.namespace) | where ann has "argocd.argoproj.io/hook" and (ann has "PreDelete" or ann has "PostDelete") | summarize count() by ns, tostring(d.objectRef.resource)
Hunting — SPL
spl 
index=k8s_audit sourcetype="kube:apiserver:audit" user.username="system:serviceaccount:argocd:argocd-application-controller" | spath path=requestObject.metadata.annotations output=ann | search ann="*argocd.argoproj.io/hook*" (ann="*PreDelete*" OR ann="*PostDelete*") | stats count by objectRef.namespace, objectRef.resource

Atomic Red Team Tests

Test 1 PreDelete hook targeting out-of-project namespace
linux

Simulates an Application with a PreDelete hook Job annotated to run in a namespace outside the AppProject destination allow-list.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: batch/v1
kind: Job
metadata:
  name: predelete-hook-test
  namespace: restricted-target
  annotations:
    argocd.argoproj.io/hook: PreDelete
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: probe
        image: busybox:1.36
        command: ["sh","-c","echo predelete-hook-fired"]
EOF

Cleanup

bash 
kubectl delete job predelete-hook-test -n restricted-target --ignore-not-found

Expected Telemetry

Kubernetes audit event: create jobs in namespace restricted-target with annotation argocd.argoproj.io/hook=PreDelete by the controller service account

Expected Detection

Detection fires on PreDelete hook Job created in an out-of-project namespace.

Test 2 PostDelete hook creating privileged RBAC binding
linux

Simulates a PostDelete hook that creates a ClusterRoleBinding, representing privilege escalation via the restriction bypass.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: postdelete-hook-crb-test
  annotations:
    argocd.argoproj.io/hook: PostDelete
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
EOF

Cleanup

bash 
kubectl delete clusterrolebinding postdelete-hook-crb-test --ignore-not-found

Expected Telemetry

Kubernetes audit event: create clusterrolebindings with annotation argocd.argoproj.io/hook=PostDelete

Expected Detection

Detection fires on PostDelete hook creating a cluster-scoped RBAC binding.

Test 3 Hook pod in kube-system namespace
linux

Simulates a delete-phase hook pod placed in kube-system, a namespace no tenant AppProject should permit.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: hook-pod-test
  namespace: kube-system
  annotations:
    argocd.argoproj.io/hook: PreDelete
spec:
  restartPolicy: Never
  containers:
  - name: probe
    image: busybox:1.36
    command: ["sh","-c","sleep 5"]
EOF

Cleanup

bash 
kubectl delete pod hook-pod-test -n kube-system --ignore-not-found

Expected Telemetry

Kubernetes audit event: create pods in kube-system with argocd.argoproj.io/hook annotation

Expected Detection

Detection fires on a delete-phase hook pod in kube-system.

Related Detections

Tactic Hubs

TA0004 Privilege Escalation TA0008 Lateral Movement ATT&CK Matrix

Related Techniques

T1078 Valid Accounts T1548 Abuse Elevation Control Mechanism

Same Tactic: Privilege Escalation

Popular Detections