Vulnpedia
← Search CVEs

CVE-2026-55797

HIGH 8.8

Published 2026-10-09 · Last modified 2026-10-09

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

ELEVATED IMPACT

Severe if exploited (CVSS 8.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.9%chance of exploitation in 30 days · 79th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.8CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Argoproj

Products Argo Cd

Weakness (CWE)

  • CWE-78: : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/argoproj/argo-cd/v2 Go

    pkg:golang/github.com/argoproj/argo-cd/v2

    SEMVER range
    • Introduced version (included): 2.11.0
    • Last affected version (included): 2.14.21
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j6cw-g6p4-7hch/GHSA-j6cw-g6p4-7hch.json"
  }
}
    GitHub Advisory Database · GHSA-j6cw-g6p4-7hch · Updated 2026-10-21T03:11:56.486094067Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.0.0
    • Fixed boundary (excluded): 3.3.15
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j6cw-g6p4-7hch/GHSA-j6cw-g6p4-7hch.json"
  }
}
    GitHub Advisory Database · GHSA-j6cw-g6p4-7hch · Updated 2026-10-21T03:11:56.486094067Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.4.0
    • Fixed boundary (excluded): 3.4.10
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j6cw-g6p4-7hch/GHSA-j6cw-g6p4-7hch.json"
  }
}
    GitHub Advisory Database · GHSA-j6cw-g6p4-7hch · Updated 2026-10-21T03:11:56.486094067Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.5.0
    • Fixed boundary (excluded): 3.5.4
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j6cw-g6p4-7hch/GHSA-j6cw-g6p4-7hch.json"
  }
}
    GitHub Advisory Database · GHSA-j6cw-g6p4-7hch · Updated 2026-10-21T03:11:56.486094067Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.6.0-rc1
    • Fixed boundary (excluded): 3.6.0-rc2
    1 explicitly listed affected versions

    3.6.0-rc1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j6cw-g6p4-7hch/GHSA-j6cw-g6p4-7hch.json"
  }
}
    GitHub Advisory Database · GHSA-j6cw-g6p4-7hch · Updated 2026-10-21T03:11:56.486094067Z
  • github.com/argoproj/argo-cd Go

    pkg:golang/github.com/argoproj/argo-cd

    SEMVER range
    • All earlier versions (introduced 0)
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6701.json"
  }
}
    Go Vulnerability Database · GO-2026-6701 · Updated 2026-10-19T21:40:54.044086655Z
  • github.com/argoproj/argo-cd/v2 Go

    pkg:golang/github.com/argoproj/argo-cd/v2

    SEMVER range
    • Introduced version (included): 2.11.0
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6701.json"
  }
}
    Go Vulnerability Database · GO-2026-6701 · Updated 2026-10-19T21:40:54.044086655Z
  • github.com/argoproj/argo-cd/v3 Go

    pkg:golang/github.com/argoproj/argo-cd/v3

    SEMVER range
    • Introduced version (included): 3.0.0
    • Fixed boundary (excluded): 3.3.15
    • Introduced version (included): 3.4.0
    • Fixed boundary (excluded): 3.4.10
    • Introduced version (included): 3.5.0
    • Fixed boundary (excluded): 3.5.4
    • Introduced version (included): 3.6.0-rc1
    • Fixed boundary (excluded): 3.6.0-rc2
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6701.json"
  }
}
    Go Vulnerability Database · GO-2026-6701 · Updated 2026-10-19T21:40:54.044086655Z

Vendor product assessments

  • odf4/odf-multicluster-rhel9-operator as a component of Red Hat Openshift Data Foundation 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/odf-multicluster-rhel9-operator@sha256:784dc8dfb9f6b6bb8f7ef8047852b903aeb20ac4b2506b5b9bd2af51b6062bed?repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator

    • none available: Affected
    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00
  • openshift-gitops-1/argocd-image-updater-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-image-updater-rhel9@sha256:b973526c361b32580e0b4fb9670ed602ee13b34b8474115d35e6aa3155212d9d?repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9

    • none available: Affected
    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00
  • openshift-gitops-1/gitops-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9@sha256:aecc69f70bc4f6c268f2a4d779376859fe373a56be8cbea7ab920ef35289c218?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9

    • none available: Affected
    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00
  • openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9-operator@sha256:8a0efea00453e415aca54cfb6860a7e1df5139b8fb27ad304d1116df89a45186?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator

    • none available: Affected
    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00
  • openshift-gitops-1/argocd-agent-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/argocd-agent-rhel9@sha256:4cef4a3651c7219d4d9d7e106bf3166d6f917b3e1806fca016c7d19f7fc4bb3a?repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9

    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00
  • openshift-gitops-1/argocd-rhel9 as a component of Red Hat OpenShift GitOps · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/argocd-rhel9@sha256:a82f8ec909e149f97b51038abe5f18cf0b0be022ee25c845e8f2e3cfb80f5769?repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9

    Red Hat · CVE-2026-55797 · Updated 2026-10-20T08:38:29+00:00

All CVSS metrics

  • HIGH 8.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • HIGH 8.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS