CVE-2026-55797
published 2026-10-09CVE-2026-55797: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is…
PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.55%
74.9th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| github.com | argoproj_argo-cd_v2 | 2.11.0 – 2.14.21 | — |
| github.com | argoproj_argo-cd_v3 | >= 3.0.0 < 3.3.15 | 3.3.15 |
| github.com | argoproj_argo-cd_v3 | >= 3.4.0 < 3.4.10 | 3.4.10 |
| github.com | argoproj_argo-cd_v3 | >= 3.5.0 < 3.5.4 | 3.5.4 |
| github.com | argoproj_argo-cd_v3 | >= 3.6.0-rc1 < 3.6.0-rc2 | 3.6.0-rc2 |
| odf4 | odf-multicluster-rhel9-operator | — | — |
| openshift-gitops-1 | argocd-agent-rhel9 | — | — |
| openshift-gitops-1 | argocd-image-updater-rhel9 | — | — |
| openshift-gitops-1 | gitops-rhel9 | — | — |
| openshift-gitops-1 | gitops-rhel9-operator | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Argo Project Argo CD up to 3.6.0-rc1 repo-server command injection
vuldb·2026-10-09·CVSS 8.8
CVE-2026-55797 [HIGH] Argo Project Argo CD up to 3.6.0-rc1 repo-server command injection
A vulnerability was found in Argo Project Argo CD up to 2.14.21/3.3.14/3.4.9/3.5.3/3.6.0-rc1 and classified as very critical. The impacted element is an unknown function of the component repo-server. Executing a manipulation can lead to command injection.
This vulnerability is tracked as CVE-2026-55797. The attack can be launched remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
ghsa·2026-10-09
CVE-2026-55797 [HIGH] CWE-78 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
### Impact
Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server.
All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and earlier are not. The behavior was introduced in [9b27aeb1a4](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) (2024-01-09, [#15864](https://github.com/argoproj/argo-cd/pull/15864)), the change that added SOCKS5 proxy support for SSH Git URLs, and was first released in v2.11.0.
The r
Red Hat
github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: Arbitrary command execution via crafted SSH repository proxy configuration
vendor_redhat·2026-10-09·CVSS 8.8
CVE-2026-55797 [HIGH] CWE-78 github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: Arbitrary command execution via crafted SSH repository proxy configuration
github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: Arbitrary command execution via crafted SSH repository proxy configuration
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.
No detection rules found.
No public exploits indexed.
https://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9fhttps://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205https://github.com/argoproj/argo-cd/pull/15864https://github.com/argoproj/argo-cd/releases/tag/v3.3.15https://github.com/argoproj/argo-cd/releases/tag/v3.4.10https://github.com/argoproj/argo-cd/releases/tag/v3.5.4https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch
2026-10-09
Published