Read the docs
TI-2026-70041 Aliases CVE-2026-55797GHSA-j6cw-g6p4-7hch

Command injection in Argo CD repo-server via SSH repository proxy URL

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

Argo CD from 2.11.0 through 2.14.21, from 3.0.0 before 3.3.15, from 3.4.0 before 3.4.10, and from 3.5.0 before 3.5.4 is affected, along with version 3.6.0-rc1. The repo-server places an SSH repository proxy host and port into a ProxyCommand that runs through a shell without neutralizing shell metacharacters, which is CWE-78. A user who can create or update a repository or repository credential template can supply a crafted proxy host to run commands in the repo-server and reach its Git, Helm, and OCI credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01869 79th percentileScored 2026-11-07
Fix Partial argo-cd (argoproj): 3.3.15, 3.4.10, 3.5.4github.com/argoproj/argo-cd/v3 (Go): 3.3.15, 3.4.10, 3.5.4 +1Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
argoprojargo-cd2.11.0 – 2.14.21; 3.0.0 to before 3.3.15; 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.4; = 3.6.0-rc13.3.15, 3.4.10, 3.5.4Patch availableCNA
—github.com/argoproj/argo-cd/v2 (Go)2.11.0 – 2.14.21—No fix listedGHSA-j6cw-g6p4-7hch
—github.com/argoproj/argo-cd/v3 (Go)3.0.0 to before 3.3.153.3.15Patch availableGHSA-j6cw-g6p4-7hch
—github.com/argoproj/argo-cd/v3 (Go)3.4.0 to before 3.4.103.4.10Patch availableGHSA-j6cw-g6p4-7hch
—github.com/argoproj/argo-cd/v3 (Go)3.5.0 to before 3.5.43.5.4Patch availableGHSA-j6cw-g6p4-7hch
—github.com/argoproj/argo-cd/v3 (Go)3.6.0-rc1 to before 3.6.0-rc23.6.0-rc2Patch availableGHSA-j6cw-g6p4-7hch
  • argo-cd Vendorargoproj Affected 2.11.0 – 2.14.21; 3.0.0 to before 3.3.15; 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.4; = 3.6.0-rc1 Fixed in 3.3.15, 3.4.10, 3.5.4 Patch available CNA
  • github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.11.0 – 2.14.21 Fixed in — No fix listed GHSA-j6cw-g6p4-7hch
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.0.0 to before 3.3.15 Fixed in 3.3.15 Patch available GHSA-j6cw-g6p4-7hch
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.4.0 to before 3.4.10 Fixed in 3.4.10 Patch available GHSA-j6cw-g6p4-7hch
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.5.0 to before 3.5.4 Fixed in 3.5.4 Patch available GHSA-j6cw-g6p4-7hch
  • github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected 3.6.0-rc1 to before 3.6.0-rc2 Fixed in 3.6.0-rc2 Patch available GHSA-j6cw-g6p4-7hch

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*——argoproj
  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions — — ·argoproj

Remediation

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2. The sources list no fixed version for github.com/argoproj/argo-cd/v2. Red Hat fixes OpenShift GitOps 1.20 in RHSA-2026:77273, 1.21 in RHSA-2026:77269 and 1.22 in RHSA-2026:77267. Red Hat lists no available plan for Red Hat Openshift Data Foundation 4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA argo-cd (argoproj) Fixed in 3.3.15, 3.4.10, 3.5.4
  • Fix · GHSA-j6cw-g6p4-7hch github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.3.15 Advisory →
  • Fix · GHSA-j6cw-g6p4-7hch github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.4.10 Advisory →
  • Fix · GHSA-j6cw-g6p4-7hch github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.5.4 Advisory →
  • Fix · GHSA-j6cw-g6p4-7hch github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.6.0-rc2 Advisory →

Red Hat 3 advisories

  • RHSA-2026:77273 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.8 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:77267 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.22.1 security update
    • Red Hat OpenShift GitOps 1.22 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:77273
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Red Hat OpenShift GitOps 1.22Fixed RHSA-2026:77267
Not affected: 4 products
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift GitOps 1.22

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-55797
  2. 2026-10-09 Alias added: GHSA-j6cw-g6p4-7hch
  3. 2026-10-11 Priority changed: LOW → MEDIUM
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-20 CVSS score added · Red Hat
  6. 2026-11-03 Fix available: RHSA-2026:90323 · Red Hat
  7. 2026-11-03 Fix available: RHSA-2026:90337 · Red Hat
  8. 2026-11-03 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21 · Red Hat
  9. 2026-11-05 Fix available: Red Hat OpenShift GitOps 1.22 · Red Hat
  10. 2026-11-05 Affected versions changed · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:77267 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:77269 · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:77273 · Red Hat

References

Other 9

  • TI-2026-22564 Argo Workflows has unauthorized access to Argo Workflows Template CVSS 3.1CRITICAL 9.8
  • TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
  • TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
  • TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
  • TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
  • TI-2026-30603 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor CVSS 4.0HIGH 8.2
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences