Provenance Record

Clear News structure (Overview, four critical issues, other four, operator actions, unknowns). Mechanism-level description only; no payloads or crafted-input examples. The advisory-level mention that a dash-prefixed ref can be parsed as a Git option with --upload-pack is the vendor own impact description and gives no working command. Title 142 chars (cap 150). Body 785 words raw and 785 with link URLs stripped (link URLs are attached to link text tokens), inside the News range 400-1200.

All 12 snapshots exist (source-0..11.html.gz, HTTP 200, archive_fallback not set, no error) and contain the real page body, not just chrome; none needed a live fallback. No suspicious_patterns on any source; no instruction-like text found. github.com is already in config/source_allowlist.txt (single entry); no allowlist change. Release pages: v3.5.4 released 2026-10-06T20:55:31Z, v3.4.10 20:58:18Z, v3.3.15 21:35:42Z, v3.6.0-rc2 20:50:11Z, rc2 carries the Pre-release label; all four list the identical 8-item security section and the same two potentially-breaking changes (helmGlobals.configHome no longer honored; OCI manifest above 4 MiB rejected). Per-advisory verification (all published Oct 7, 2026 by crenshaw-dev; all eight show patched versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2 for the v3 module, so the title versions are fixed versions for every advisory): (1) GHSA-9v9p-x54c-58gc Kustomize remote ref, Critical 9.9, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, No known CVE, affected >=2.7.0 (v2 module, no v2 patch) and v3 >=3.0.0 below fixed versions or =3.6.0-rc1, reporters hoang-prod and yabeow, no complete workaround besides upgrading (verbatim). (2) GHSA-fw5c-w8rc-j7fx Kustomize Helm config home, Critical 9.9 same vector, No known CVE, affected >=2.1.0, reporter hoang-prod, workaround do not pass --enable-helm in kustomize.buildOptions (complete workaround). (3) GHSA-m3vr-7329-44ww Jsonnet import, Critical 9.9 same vector, No known CVE, affected >=0.9.0, many reporters led by hoang-prod, workaround jsonnet.enable "false" in argocd-cm. (4) GHSA-fmxq-cgp8-87wp PreDelete/PostDelete hooks bypass AppProject, Critical 9.9 same vector, CVE-2026-77459 (CWE-863), affected >=2.10.0, reporters RealFakeAccount, AdamKorcz and others. Exactly four Critical, each 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; the article mapping of three repo-server issues plus the delete-hook issue to the right GHSA IDs is correct. (5) GHSA-j6cw-g6p4-7hch SSH proxy URL command injection, High 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CVE-2026-55797 (CWE-78), affected >=2.11.0, 8 reporters; SSH repositories only; out-of-support statement matches. (6) GHSA-4439-h7jw-5cjj login rate limit, High 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CVE-2025-61560 (CWE-307, CWE-362; the 2025 year is what both the release notes and the advisory page show, so no mismatch), affected >=1.5.3, reporters foussey and shivamkumarcyber; defaults 5 failures per 5-minute window confirmed. (7) GHSA-w996-f2wq-x9c6 oversized OCI manifest, Moderate 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, No known CVE, affected >=3.1.0 (v3 only), reporter andrejtomci, fix rejects manifest above 4 MiB. (8) GHSA-g3ff-q88g-chrj extension proxy RBAC, Moderate 4.9, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N, No known CVE, affected >=2.7.0, nine reporters; applies only when proxy extensions and applications-in-any-namespace are both enabled. CVE claim check: the release notes and advisory pages agree that only three of eight carry CVE IDs (CVE-2026-77459, CVE-2025-61560, CVE-2026-55797); the other five pages show No known CVE. I read the SSH, login, OCI and extension-proxy advisories in full myself, including the 4 MiB OCI limit and the Helm configHome change. No page says anything about exploitation in the wild (searched all 12 snapshots for exploited, in the wild, proof of concept: no hits), so the article no-exploitation-reported statement is accurate.

Every number, ID, version range, date, workaround and attribution traces to the snapshots; vendor claims are attributed to the project advisories and release notes and the freshness (read October 10, 2026) is stated. One imprecision: the operators section says the advisories for the AppProject, SSH proxy, login and OCI issues state that Argo CD 2.x and 3.0 through 3.2 are out of support. Actual wording differs: AppProject, SSH and extension-proxy advisories say 2.x and 3.0 through 3.2; the login advisory says 1.x, 2.x and 3.0 through 3.2; the OCI advisory says only 3.1 and 3.2 are affected and out of support (OCI is not present before 3.1). The extension-proxy advisory, which carries the same statement, is not named. The three repo-server Critical advisories do not state out-of-support in prose but list no patch for v2 and none for v3 below 3.3, which supports the summary line that older lines get no patch. This is a subordinate-paragraph generalisation, not headline or lead, so it is filed as a clarification.

Accurate, well-sourced security-release News piece with the correct Critical count, scores, CVE mapping and patched versions. Publish with a one-entry clarification.