Knowledge Base

In Argo CD versions from 2.10.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-77459 was detected. This vulnerability allows an attacker with write access to an Application’s Git repository to bypass destination and resource authorization checks, potentially creating unauthorized resources within the Kubernetes cluster. This occurs because Argo CD creates PostDelete resource hooks without applying the standard AppProject allow/deny lists used during normal synchronization. By committing a maliciously crafted delete hook targeting a forbidden namespace, server, group, or kind, the attacker can force the application-controller to create that resource using its destination-cluster credentials when the Application is deleted. While the impact is bounded by the controller’s own access rights, it can lead to the compromise of cluster-scoped resources and disallowed namespaces. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77459.

In Appwrite versions up to 2.3.0 a medium severity vulnerability CVE-2026-108770 was detected. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) attacks, potentially gaining unauthorized access to internal network resources or services. This occurs due to a flaw in the PublicHostname function within the src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php file of the Browser Screenshot Service component. By manipulating the url argument, an attacker can trick the server into making unintended outbound HTTP requests on their behalf. To address this issue, users should upgrade Appwrite to version 2.4.0 or later, or apply the official patch (commit 393255e7302ae5503331d45802e2eee01c6a47fe). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-108770.

In Django versions from 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7 a low severity vulnerability CVE-2025-59682 was detected. This vulnerability allows for partial directory traversal, potentially leading to unauthorized file writes outside the intended target directory. This occurs due to a flaw in the django.utils.archive.extract() function, which is utilized when developers run the startapp --template and startproject --template management commands. If a developer uses a maliciously crafted archive where file paths share a common prefix with the target directory, the extraction process can escape the intended extraction path. To address this issue, users should upgrade Django to versions 4.2.25, 5.1.13, 5.2.7, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59682.

In Teradata provider component for Apache Airflow versions earlier than 3.7.0 a medium severity vulnerability CVE-2026-81862 was detected. This vulnerability allows an attacker to potentially expose sensitive cloud storage credentials. To address this issue, users should upgrade Teradata provider to version 3.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81862.

In Google provider component for Apache Airflow versions prior to 22.6.0 a medium severity vulnerability CVE-2026-81914 was detected. This vulnerability allows an attacker to append arbitrary clauses to Google Drive search queries. To address this issue, users should upgrade Apache Airflow to version 22.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81914.

In Ubuntu versions before 0.1.19ubuntu3 a medium severity vulnerability CVE-2026-102371 was detected. This vulnerability allows an unprivileged local user to read the Ubuntu Pro token from process command-line arguments. To address this issue, users should upgrade Ubuntu to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102371.