Argo CD
v3.5.2 →v3.5.7
TRAVERSAL PIPELINE5 releases
ORIGINv3.5.2TARGETv3.5.7
- v3.5.3: a blocking change
- v3.5.4: a blocking change
- v3.5.5: a blocking change
- v3.5.6: a blocking change
- v3.5.7: not analysed
20265 releases2026
- Releases to cross
- 5
- Spanning
- 2 mo
- Need action
- 11
What breaks
Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allowing Kustomize remote refs to run commands on the repo-server.
CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
- blocker
Critical vulnerability allowing Kustomize Helm config home to run commands on the repo-server.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
- blocker
Critical vulnerability allowing Jsonnet imports to read files from the repo-server.
CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
- blocker
Critical vulnerability bypassing AppProject restrictions via PreDelete/PostDelete resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
- high
High severity login failure rate limit can be bypassed via concurrent requests.
HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds dependent on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/adv…
- low
Moderate extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
Releases in this span
| Version | Released | Changes | Source |
|---|---|---|---|
| v3.5.3 | 2026-09-14 | 1 | changelog |
| v3.5.4 | 2026-10-06 | 9 | changelog |
| v3.5.5 | 2026-10-12 | 1 | changelog |
| v3.5.6 | 2026-10-20 | 1 | changelog |
| v3.5.7 | 2026-11-02 | not analysed | changelog |