Home / DEVOPS / Argo CD / v3.5.4
Argo CD v3.5.4stable Released Oct 06, 2026
⚠️ Breaking Change Impact Score: 7/10

Argo CD v3.5.4 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: argocd · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Breaking-change evidence from the source

  • Potentially-breaking changes * Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)).
Read the original context ↗
Source flags breaking changes — review applicability
📄 .MD
✨ Features 1 🔧 Bug Fixes 6 ⚠️ Breaking & Deprecations 1
⚡ Executive Summary (TL;DR)

Argo CD v3.5.4. Source highlight: kubectl create namespace argocd

Visit Argo CD Official Site ↗ Official Release Source ↗ All Argo CD Releases 📡 Argo CD RSS
Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

⚠️ Breaking Changes & Deprecations (1)

  • Potentially-breaking changes * Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)).

✨ New Features & Capabilities (1)

  • f37dc0c742724e1b5f2393839a24d9664f31ede7: feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#29861) (@argo-cd-cherry-pick-bot[bot])

🔧 Bug Fixes & Patches (6)

  • CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
  • CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
  • CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
  • CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
  • HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
  • HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
📄 View Raw Release Notes (Original Developer Log)
## Quick Start ### Non-HA: ```shell kubectl create namespace argocd kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/install.yaml ``` ### HA: ```shell kubectl create namespace argocd kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/ha/install.yaml ``` ## Release Signatures and Provenance All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify. ## Release Notes Blog Post For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f) ## Upgrading If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation. ## Changelog ### Security fixes * CRITICAL: A Kustomize remote ref can run commands in the repo-server ([GHSA-9v9p-x54c-58gc](https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc)) * CRITICAL: A Kustomize Helm config home can run commands in the repo-server ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)) * CRITICAL: A Jsonnet import can read files from the repo-server ([GHSA-m3vr-7329-44ww](https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww)) * CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks ([GHSA-fmxq-cgp8-87wp](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp), CVE-2026-77459) * HIGH: Login failure rate limit can be bypassed via concurrent requests ([GHSA-4439-h7jw-5cjj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj), CVE-2025-61560) * HIGH: Command injection via a repository proxy URL on SSH Git repositories ([GHSA-j6cw-g6p4-7hch](https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch), CVE-2026-55797) * MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled ([GHSA-g3ff-q88g-chrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-g3ff-q88g-chrj)) * MODERATE: An oversized OCI manifest can exhaust repo-server memory ([GHSA-w996-f2wq-x9c6](https://github.com/argoproj/argo-cd/security/advisories/GHSA-w996-f2wq-x9c6)) ### Potentially-breaking changes * Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)). * An OCI manifest larger than 4 MiB is now rejected ([GHSA-w996-f2wq-x9c6](https://github.com/argoproj/argo-cd/security/advisories/GHSA-w996-f2wq-x9c6)). ### Features * f37dc0c742724e1b5f2393839a24d9664f31ede7: feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#29861) (@argo-cd-cherry-pick-bot[bot]) ### Bug fixes * 5c8aa4620c0a606e9fe5e03a07e3dcaabe81fbe6: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.5) (#29773) (@argo-cd-cherry-pick-bot[bot]) * 7f0a05834b05103d69d7c150e1ee36541b314696: fix(security): coordinated security fixes (release-3.5) (#30038) (@crenshaw-dev) * 482c71a558b3001e028316232fe2f86c25becb09: fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.5) (#29725) (@crenshaw-dev) * 1f8100a3db64fdc520b768c5606b6fca4e4ad09c: fix: cherry-pick #29737 (release-3.5) (#29749) (@blakepettersson) * 9886fc1363e92a517b811375505317912cdb82b9: fix: use ObjectMeta in session login test (release-3.5) (#29919) (@crenshaw-dev) ### Other work * a9d0b9684a6470741a9ee61a05d4f70eb76c85d6: fix(manifest-generate-paths): do not report changes on cache miss without path updates (cherry-pick #29442 for 3.5) (#29849) (@argo-cd-cherry-pick-bot[bot]) * fc2d94d906db9e0a4650e7936036022cc9fe232d: fix(repo-server): cherry-pick health check timeout resulting in CrashLoopBackOff to release-3.5 branch (#29901) (@aali309) * f0de0be59114d7eb3bfb3b4c2793b65ba013ad1f: test(flaky): accept connection reset by peer as valid mTLS rejection (cherry-pick #28367 for 3.5) (#29850) (@argo-cd-cherry-pick-bot[bot]) **Full Changelog**: https://github.com/argoproj/argo-cd/compare/v3.5.3...v3.5.4 <a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>
← Older Version Argo CD v3.5.3