Argo CD v3.5.4
breakingsecurity+******!!!!!!!!!!!
Argo CD v3.5.4 ships 19 changes, 11 of them security fixes, including several critical issues in the repo-server: Kustomize remote refs and Helm config home can run commands, and Jsonnet imports can read files. It also fixes an AppProject restriction bypass via PreDelete/PostDelete hooks and a high-severity command injection through repository proxy URLs on SSH Git repositories. Two changes are marked breaking: Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, and OCI manifests larger than 4 MiB are now rejected.
What changes for platform teams
Platform teams running Argo CD 3.5 should upgrade to pick up the repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from a custom config home, or with OCI manifests above 4 MiB, need to check their builds before upgrading because those will fail.
Changes
- !Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
- !An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
- CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
- CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
- CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
- CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
- HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
- HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
- MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
- MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
- 7f0a05834b05103d69d7c150e1ee36541b314696: fix(security): coordinated security fixes (release-3.5) (#30038) (@crenshaw-dev)security
- F37dc0c742724e1b5f2393839a24d9664f31ede7: feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#29861) (@argo-cd-cherry-pick-bot[bot])added
6 more lines
- 5c8aa4620c0a606e9fe5e03a07e3dcaabe81fbe6: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.5) (#29773) (@argo-cd-cherry-pick-bot[bot])fixed
- 482c71a558b3001e028316232fe2f86c25becb09: fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.5) (#29725) (@crenshaw-dev)fixed
- 1f8100a3db64fdc520b768c5606b6fca4e4ad09c: fix: cherry-pick #29737 (release-3.5) (#29749) (@blakepettersson)fixed
- 9886fc1363e92a517b811375505317912cdb82b9: fix: use ObjectMeta in session login test (release-3.5) (#29919) (@crenshaw-dev)fixed
- A9d0b9684a6470741a9ee61a05d4f70eb76c85d6: fix(manifest-generate-paths): do not report changes on cache miss without path updates (cherry-pick #29442 for 3.5) (#29849) (@argo-cd-cherry-pick-bot[bot])fixed
- Fc2d94d906db9e0a4650e7936036022cc9fe232d: fix(repo-server): cherry-pick health check timeout resulting in CrashLoopBackOff to release-3.5 branch (#29901) (@aali309)fixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- F0de0be59114d7eb3bfb3b4c2793b65ba013ad1f: test(flaky): accept connection reset by peer as valid mTLS rejection (cherry-pick #28367 for 3.5) (#29850) (@argo-cd-cherry-pick-bot[bot])maintenance
Full release notes ↗ · all Argo CD releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules