Bug 2565914 (CVE-2026-121621)

Summary:	CVE-2026-121621 github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: Arbitrary command execution via crafted SSH repository proxy configuration
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anjoseph, jprabhak, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 16:13:07 UTC

A command injection flaw was found in Argo CD Image Updater. When Argo CD Image Updater clones or fetches a Git repository over SSH that has a proxy configured, the proxy host and port are copied into an SSH ProxyCommand that is passed to Git through the shell-interpreted GIT_SSH_COMMAND environment variable. Because the proxy host and port are not neutralized, a proxy URL whose hostname contains shell metacharacters can break out of the intended command and execute arbitrary commands in the context of the Image Updater process.
This is the same class of issue as CVE-2026-55797 in Argo CD (GHSA-j6cw-g6p4-7hch), which stems from the SOCKS5 proxy support for SSH Git URLs. Argo CD Image Updater shares the affected credential/proxy handling code (ext/git/creds.go), so it is affected in the same way.
Only SSH repositories are affected: http, https, and socks5 proxy URLs all take this code path when set on an SSH repository. An HTTPS Git repository uses the proxy as an HTTP proxy and does not build this command. Anyone able to create or update a repository, a repository credential template, or the backing repository Secret can set a malicious proxy value. The command is executed when the repository connection is tested and on subsequent fetches, and the resulting process can access other Git, Helm, and OCI credentials available to Image Updater.
The fix validates the proxy URL (scheme, hostname, and port) and writes the proxy settings to a temporary wrapper script instead of embedding the host and port directly into the shell-interpreted GIT_SSH_COMMAND string, preventing shell metacharacters from being interpreted.
Upstream fix:
https://github.com/argoproj-labs/argocd-image-updater/pull/1905
References:
https://github.com/advisories/GHSA-j6cw-g6p4-7hch
https://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f