Bug 2548730 (CVE-2026-55797) - CVE-2026-55797 github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: Arbitrary command execution via crafted SSH repository proxy configuration
Summary: CVE-2026-55797 github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2...
Keywords:
Status: NEW
Alias: CVE-2026-55797
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-09 17:02 UTC by OSIDB Bzimport
Modified: 2026-10-19 19:04 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-09 17:02:22 UTC 
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Note You need to log in before you can comment on or make changes to this bug.