# Argo CD v3.4.10 — Release & Upgrade Intelligence
- **Product:** Argo CD (https://argo-cd.readthedocs.io)
- **Version:** v3.4.10
- **Released:** Oct 06, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/argocd/updates/v3.4.10/

## Executive Summary (TL;DR)
Argo CD v3.4.10. Source highlight: kubectl create namespace argocd

## Breaking Changes & Deprecations
- Potentially-breaking changes * Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)).

## New Features
- 4469a335a79f7b9ab8e263179f507cd21fc19834: feat(server): log username on login attempts (cherry-pick #29841 for 3.4) (#29860) (@argo-cd-cherry-pick-bot[bot])

## Bug Fixes
- CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
- CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
- CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
- CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
- HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
- HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)