Before this update, all versions of Argo CD v2.9.2 and later were vulnerable to cross-server request forgery (CSRF) attacks. As a result, Argo CD would accept non-GET requests even if they did not specify their content type. This update fixes the issue by upgrading the Argo CD to v.2.9.5 and patching this vulnerability in the Argo CD API. IMPORTANT: Breaking change: The Argo CD API will no longer accept non-GET requests that do not specify application or JSON as their content type. Although the accepted content types list is configurable, do not disable the content type check completely. Link: https://issues.redhat.com/browse/GITOPS-3923 [ GITOPS-3923 ]