⚠️ Breaking Change
Impact Score: 7/10
Argo CD v2.3.6 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: argocd · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
Breaking-change evidence from the source
Potentially-breaking changes The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
⚡ Executive Summary (TL;DR)
Argo CD v2.3.6. Source highlight: kubectl create namespace argocd
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
⚠️ Breaking Changes & Deprecations (1)
- Potentially-breaking changes The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
🔧 Bug Fixes & Patches (3)
- HIGH: Certificate verification is skipped for connections to OIDC providers (GHSA-7943-82jg-wmw5)
- LOW: A leaked API server encryption key can allow XSS for SSO users (GHSA-pmjg-52h9-72qv)
- fix: webhook typo in case of error in GetManifests (#9671)
📄 View Raw Release Notes (Original Developer Log)
## Quick Start
### Non-HA:
```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.3.6/manifests/install.yaml
```
### HA:
```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.3.6/manifests/ha/install.yaml
```
### Security fixes
* HIGH: Certificate verification is skipped for connections to OIDC providers ([GHSA-7943-82jg-wmw5](https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5))
* LOW: A leaked API server encryption key can allow XSS for SSO users ([GHSA-pmjg-52h9-72qv](https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv))
### Potentially-breaking changes
The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
connections to your OIDC provider fails validation, SSO will be broken for your Argo CD instance. You should test 2.3.6
before upgrading it to production. From the new documentation:
> By default, all connections made by the API server to OIDC providers (either external providers or the bundled Dex
> instance) must pass certificate validation. These connections occur when getting the OIDC provider's well-known
> configuration, when getting the OIDC provider's keys, and when exchanging an authorization code or verifying an ID
> token as part of an OIDC login flow.
>
> Disabling certificate verification might make sense if:
> * You are using the bundled Dex instance **and** your Argo CD instance has TLS configured with a self-signed certificate
> **and** you understand and accept the risks of skipping OIDC provider cert verification.
> * You are using an external OIDC provider **and** that provider uses an invalid certificate **and** you cannot solve
> the problem by setting `oidcConfig.rootCA` **and** you understand and accept the risks of skipping OIDC provider cert
> verification.
>
> If either of those two applies, then you can disable OIDC provider certificate verification by setting
> `oidc.tls.insecure.skip.verify` to `"true"` in the `argocd-cm` ConfigMap.
### Bug fixes
* fix: webhook typo in case of error in GetManifests (#9671)