Command Injection Vulnerability in Argo CD Repository Server
CVE-2026-55797
Key Information:
Badges
What is CVE-2026-55797?
Argo CD, a continuous delivery tool for Kubernetes, is susceptible to command injection when handling SSH Git repositories with a proxy URL. This issue arises in versions from 2.11.0 to specific releases in the 3.x series, allowing users with the ability to create or modify repository configurations to inject malicious commands. By supplying a crafted proxy host in the SSH ProxyCommand, an attacker can execute arbitrary commands on the repo-server, thereby gaining unauthorized access to sensitive credentials such as Git, Helm, and OCI. This vulnerability has been addressed in later versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
Affected Version(s)
argo-cd >= 2.11.0, <= 2.14.21 <= 2.11.0, 2.14.21
argo-cd >= 3.0.0, < 3.3.15 < 3.0.0, 3.3.15
argo-cd >= 3.4.0, < 3.4.10 < 3.4.0, 3.4.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.