# Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Argo CD skips AppProject destination/resource checks when creating PreDelete/PostDelete hooks, letting a Git pusher create cluster-scoped objects like ClusterRoleBindings on Application deletion.

- Payout: Research
- Severity: critical
- Program: Argo CD
- Found by: RealFakeAccount, AdamKorcz, 0xshylines, thevilledev
- Disclosed: 2026-10-15
- CVE: CVE-2026-77459
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-fmxq-cgp8-87wp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-fmxq-cgp8-87wp
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:ci-cd tech:kubernetes vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Argo CD application-controller delete-hook creation path
**Root cause:** The PreDelete/PostDelete hook creation path never applies the AppProject destination-namespace and resource allow/deny checks that the sync path enforces, so hooks are created with the application-controller's credentials unchecked.
**Steps:**
1. Gain push access to the Git repo backing an Application in a restrictive AppProject.
2. Commit a PreDelete or PostDelete hook manifest whose namespace, group, kind, or name the AppProject would refuse on sync (e.g. a cluster-scoped `ClusterRoleBinding`).
3. Controller sees the hook, adds the delete finalizer; Application stays Synced.
4. Delete the Application; Argo CD creates the hook with the application-controller's credentials on the destination cluster.
5. Set a deletion policy that does not remove the hook on success to leave the object in the cluster, or use a Job hook to create further objects.
**How found:** Not stated; advisory notes the PostDelete creation path (introduced 2023-12-18) has never applied the project check, and PreDelete reuses the same path.
**Exploitation:** A tenant with Git push access commits a delete hook the project would reject; on Application deletion the controller creates it with its own broad cluster credentials, yielding objects in disallowed namespaces or cluster-scoped objects like ClusterRoleBinding. Reach is bounded by the controller's RBAC on the destination cluster.
**Escalation:** Hook with a deletion policy that retains it on success persists the object; a Job hook can create further objects Argo CD does not clean up.
**Insight:** Audit lifecycle/cleanup code paths (delete hooks, finalizers, cascading deletion) separately from the main reconcile path — authorization checks added to sync often never get wired into the teardown path that reuses the controller's credentials.