Argo CD v3.4.10
breakingsecurity+****!!!!!!!!!!!
Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.
What changes for platform teams
Platform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.
Changes
- !Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
- !An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
- CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
- CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
- CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
- CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
- HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
- HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
- MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
- MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
- 4bc8085b0a6d2296b849539d3d09fc7be7a4a511: fix(security): coordinated security fixes (release-3.4) (#30039) (@crenshaw-dev)security
- 4469a335a79f7b9ab8e263179f507cd21fc19834: feat(server): log username on login attempts (cherry-pick #29841 for 3.4) (#29860) (@argo-cd-cherry-pick-bot[bot])added
4 more lines
- E7225da286ecd43eb31f41d04717ce0b9a6852a4: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.4) (#29775) (@argo-cd-cherry-pick-bot[bot])fixed
- F161802f4fa3b0f874640fdff6d92f9143ff2e20: fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.4) (#29726) (@crenshaw-dev)fixed
- 54bb5b408421de8622a15e40467932599bebdbcc: fix: cherry-pick #29737 (release-3.4) (#29765) (@blakepettersson)fixed
- 9de021aaf48fe96fde09e3906b3abdd1d5e2a9be: fix: use ObjectMeta in session login test (release-3.4) (#29918) (@crenshaw-dev)fixed
4 maintenance lines (dependency bumps, CI, tests, docs)
- 2e4811cc084e9b10f27813a16ae17fae9b664328: chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.9.0 (cherry-pick argoproj#27847 for 3.4) (#29759) (@nmirasch)maintenance
- 9c3211c4cb07184428583d2e0acd05ad5be7e49f: chore(deps): bump go.opentelemetry.io/otel from 1.43 to 1.44 (release-3.4) (#29764) (@nmirasch)maintenance
- 08da64bf920ff076913e213331dac51f56ea0059: chore(deps): bump golang.org/x/crypto to 0.57.0 (release-3.4) (#29825) (@akhilnittala)maintenance
- 999b68ca7408b843f25ab4604621a260b1d9c274: chore(deps): bump up js-yaml from 4.3.1 to 4.3.2 (#30021) (@keithchong)maintenance
Full release notes ↗ · all Argo CD releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules