Argo CD v3.3.15
breakingsecurity*********!!!!!!!!!
Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.
What changes for platform teams
Platform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.
Changes
- !Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
- !An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
- CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
- CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
- CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
- CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
- HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
- HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
- MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
- MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
- 1149cdc6e932208c4402183cc3d7b7485239940c: fix(security): coordinated security fixes (release-3.3) (#30040) (@crenshaw-dev)security
- D697764be580f902fb73587bbceb63c4c268285e: chore(deps): bump js-yaml to 4.3.1 in /ui for CVE-2026-59869 (release-3.3) (#29386) (@aali309)security
11 more lines
- C6e39fdecc8b9f59d810325ad955746a5fee38db: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.3) (#29774) (@argo-cd-cherry-pick-bot[bot])fixed
- C397ddcc9d1669d5339548b8d42bb89ed7db1da6: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.3) (#29667) (@argo-cd-cherry-pick-bot[bot])fixed
- 33ffc7d654d31d434ff844fb2d60322f182b0448: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.3) (#29526) (@argo-cd-cherry-pick-bot[bot])fixed
- 3abe9eb1d7a1fc62b07231c1de811cd59fa10579: fix(hydrator): retry notes push on cannot lock ref errors (cherry-pick #28469 for 3.3) (#29906) (@argo-cd-cherry-pick-bot[bot])fixed
- 990ea5694003dc924b03bd6e72a48c6a80273719: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.3) (#29519) (@argo-cd-cherry-pick-bot[bot])fixed
- A050c4f2d45514b5fb39b3a9d7e89f12cb5d6179: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.3) (#29433) (@omkar619-dev)fixed
- D5b193b17055a9b677b0419f3b9e5033a19306e5: fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.3) (#29727) (@crenshaw-dev)fixed
- 2cffaf528edb1e3fb8730f2075d3f128623ff4a0: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.3) (#29565) (@crenshaw-dev)fixed
- 0900428b854ce81e5a129a2ea7f74aebdb1efd81: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.3) (#29516) (@argo-cd-cherry-pick-bot[bot])fixed
- Ec1fc4524dea1880e03b4d0a31d39d7fe441ddd9: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.3) (#29272) (@argo-cd-cherry-pick-bot[bot])fixed
- 601f6112620b17708ffd65720ce055f42e3b7181: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.3) (#29522) (@argo-cd-cherry-pick-bot[bot])fixed
2 maintenance lines (dependency bumps, CI, tests, docs)
- 3249c5cdb0a5d199f42aef23ffba7b66d52a5db4: chore(deps): bump go.opentelemetry.io/otel from 1.43 to 1.44 (release-3.3) (#29763) (@nmirasch)maintenance
- 874a17c78c4e6d6bc3a4f213947717c41875f7fe: chore(deps): bump golang.org/x/crypto to 0.55.0 (release-3.3) (#29824) (@akhilnittala)maintenance
25 lines12 security11 fixed2 maintenancetyped from the source notes
Full release notes ↗ · all Argo CD releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules