CVE-2026-55797
Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Argo CD Repo-Server

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-55797
EUVD
EUVD-2026-95912

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
argoproj argo-cd >= 2.11.0, <= 2.14.21
argoproj argo-cd >= 3.0.0, < 3.3.15
argoproj argo-cd >= 3.4.0, < 3.4.10
argoproj argo-cd >= 3.5.0, < 3.5.4
argoproj argo-cd = 3.6.0-rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Argo CD versions 2.11.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 have a command injection flaw in the repo-server when handling SSH Git repositories with a proxy URL. The issue occurs because the proxy host and port are embedded in an SSH ProxyCommand executed via a shell without proper sanitization of shell metacharacters. This allows an attacker with repository update privileges to inject commands into the repo-server.

Detection Guidance

To detect this vulnerability, check if your Argo CD version is between 2.11.0 and 3.3.14, 3.4.9, 3.5.3, or 3.6.0-rc1. Inspect repository proxy URLs for SSH Git repositories for unusual or crafted inputs. Review logs for command injection attempts in the repo-server component.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the repo-server, potentially gaining access to sensitive credentials like Git, Helm, and OCI credentials stored within Argo CD. This could lead to unauthorized access to repositories, data breaches, or further compromise of the Kubernetes cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Argo CD versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Argo CD to a patched version (3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later) to fix the command injection vulnerability in the repo-server component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart