{"generated_at":"2026-10-23T14:59:08.886Z","count":1,"incidents":[{"id":"argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459","url":"https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459","title":"Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks","summary":"### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD…","severity":"critical","patch_status":"partial","status":"live","exploited":false,"affected":"github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go)","fixed_versions":["github.com/argoproj/argo-cd/v3 3.3.15","github.com/argoproj/argo-cd/v3 3.4.10","github.com/argoproj/argo-cd/v3 3.5.4","github.com/argoproj/argo-cd/v3 3.6.0-rc2"],"ids":["CVE-2026-77459"],"stack":["go","kubernetes"],"first_seen":"2026-10-15T20:19:31Z","updated_at":"2026-10-15T20:19:31Z"}]}