Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Scores

EPSS (exploitation in 30 days)

1.9% · top 21% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• argoproj · argo-cd

  • affected >= 2.11.0, <= 2.14.21
  • affected >= 3.0.0, < 3.3.15
  • affected >= 3.4.0, < 3.4.10
  • affected >= 3.5.0, < 3.5.4
  • affected = 3.6.0-rc1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/argoproj/argo-cd/v2GHSA-j6cw-g6p4-7hch (opens in a new tab)
• Gogithub.com/argoproj/argo-cd/v3GHSA-j6cw-g6p4-7hch (opens in a new tab)

References (8)

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch (opens in a new tab)x_refsource_CONFIRM
• https://github.com/argoproj/argo-cd/pull/15864 (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205 (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.15 (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.10 (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/releases/tag/v3.5.4 (opens in a new tab)x_refsource_MISC
• https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-j6cw-g6p4-7hch (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55797](https://trackcve.app/badge/CVE-2026-55797.svg)](https://trackcve.app/cve/CVE-2026-55797)

Record last updated 9 Oct 2026, 17:53 UTC.