Argo CD
v3.4.9 →v3.5.7
TRAVERSAL PIPELINE12 releases
ORIGINv3.4.9TARGETv3.5.7
- v3.4.10: a blocking change
- v3.4.11: a blocking change
- v3.4.12: a blocking change
- v3.4.13: not analysed
- v3.5.0: a blocking change
- v3.5.1: a blocking change
- v3.5.2: a blocking change
- v3.5.3: a blocking change
- v3.5.4: a blocking change
- v3.5.5: a blocking change
- v3.5.6: a blocking change
- v3.5.7: not analysed
202612 releases2026
- Releases to cross
- 12
- Spanning
- 1 mo
- Need action
- 25
What breaks
Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.
- blocker
Critical vulnerability allows command execution via Kustomize remote ref.
CRITICAL: A Kustomize remote ref can run commands in the repo-server
- blocker
Critical vulnerability allows command execution via Kustomize Helm config home.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server
- blocker
Critical vulnerability allows file reading via Jsonnet import.
CRITICAL: A Jsonnet import can read files from the repo-server
- blocker
Critical vulnerability bypasses AppProject restrictions via resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks
- blocker
Users upgrading from a different minor version must read the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
High severity login failure rate limit can be bypassed.
HIGH: Login failure rate limit can be bypassed via concurrent requests
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`.
- high
OCI manifests larger than 4 MiB are now rejected.
An OCI manifest larger than 4 MiB is now rejected
- low
Moderate severity extension proxy RBAC ignores application namespace.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled
- low
Moderate severity oversized OCI manifest can exhaust repo-server memory.
MODERATE: An oversized OCI manifest can exhaust repo-server memory
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allowing Kustomize remote refs to run commands on the repo-server.
CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
- blocker
Critical vulnerability allowing Kustomize Helm config home to run commands on the repo-server.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
- blocker
Critical vulnerability allowing Jsonnet imports to read files from the repo-server.
CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
- blocker
Critical vulnerability bypassing AppProject restrictions via PreDelete/PostDelete resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
- high
High severity login failure rate limit can be bypassed via concurrent requests.
HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds dependent on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/adv…
- low
Moderate extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
Releases in this span
| Version | Released | Changes | Source |
|---|---|---|---|
| v3.4.10 | 2026-10-06 | 11 | changelog |
| v3.4.11 | 2026-10-12 | 1 | changelog |
| v3.4.12 | 2026-10-20 | 1 | changelog |
| v3.4.13 | 2026-11-02 | not analysed | changelog |
| v3.5.0 | 2026-08-04 | 1 | changelog |
| v3.5.1 | 2026-08-12 | 1 | changelog |
| v3.5.2 | 2026-08-27 | 1 | changelog |
| v3.5.3 | 2026-09-14 | 1 | changelog |
| v3.5.4 | 2026-10-06 | 9 | changelog |
| v3.5.5 | 2026-10-12 | 1 | changelog |
| v3.5.6 | 2026-10-20 | 1 | changelog |
| v3.5.7 | 2026-11-02 | not analysed | changelog |