Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-55797

CVE-2026-55797: Argo CD SSH Proxy Command Injection Vulnerability

CVE-2026-55797 is a command injection flaw in Argo CD repo-server affecting SSH Git repositories with proxy URLs. Attackers can execute arbitrary commands and access credentials. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

Published:

CVE-2026-55797 Overview

CVE-2026-55797 is a command injection vulnerability in the Argo CD repo-server component. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The flaw affects versions from 2.11.0 up to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. When the repo-server clones, tests, or fetches an SSH Git repository configured with a proxy URL, the proxy host and port are embedded in an SSH ProxyCommand executed through a shell without neutralizing shell metacharacters. Any authenticated user who can create or update a repository or repository credential template can inject arbitrary commands. The issue is tracked under [CWE-78] (OS Command Injection).

Critical Impact

An authenticated user with repository management permissions can execute arbitrary commands on the Argo CD repo-server and steal its Git, Helm, and OCI credentials.

Affected Products

  • Argo CD versions 2.11.0 through 3.3.14
  • Argo CD versions 3.4.0 through 3.4.9
  • Argo CD versions 3.5.0 through 3.5.3 and 3.6.0-rc1

Discovery Timeline

  • 2026-10-09 - CVE CVE-2026-55797 published to NVD
  • 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-55797

Vulnerability Analysis

The Argo CD repo-server handles Git operations on behalf of the controller, including clones, connectivity tests, and periodic fetches. When a repository is configured with a proxy, the server constructs an SSH ProxyCommand string that wraps the proxy host and port. This string is then passed to a shell interpreter rather than executed directly with argument isolation.

Because the proxy host field is user-controlled and no shell metacharacter sanitization is applied, attacker-supplied characters such as ;, |, $(), or backticks are interpreted by the shell. The resulting command runs inside the repo-server pod with the privileges of that service account.

The repo-server holds sensitive credentials used to access upstream Git, Helm, and OCI registries. Successful exploitation therefore pivots from a single tenant repository configuration into supply-chain compromise across every artifact source Argo CD manages.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The proxy URL parser extracts host and port components, then concatenates them into a ssh -o ProxyCommand=... invocation that is handed to a shell. User input flows into the command string without quoting or validation.

Attack Vector

Exploitation requires an authenticated principal with permission to create or modify a repository or a repository credential template. The attacker submits a repository definition whose proxy field contains shell metacharacters followed by arbitrary commands. When the repo-server next performs an SSH operation against that repository, the injected payload executes.

go
// Patched usage pattern from the fix: proxy is passed as a structured
// argument to a dedicated proxy helper (connect-proxy / socks5), not
// concatenated into a shell command string.
//
// Example of the new, safe CLI surface introduced by the fix:
argocd repo add ssh://git@github.com/argoproj/argocd-example-apps \
  --ssh-private-key-path ~/id_rsa \
  --proxy socks5://your.proxy.server.ip:1080

argocd repo add ssh://git@github.com/argoproj/argocd-example-apps \
  --ssh-private-key-path ~/id_rsa \
  --proxy socks5://username:password@your.proxy.server.ip:1080

Source: ArgoCD Commit 9b27aeb

Stop Remote Code Execution Before It Runs

Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.

Stop Exploit Attempts

Detection Methods for CVE-2026-55797

Indicators of Compromise

  • Repository or credential template objects whose proxy field contains shell metacharacters such as ;, |, &, backticks, or $().
  • Unexpected child processes of the Argo CD repo-server container, especially shells (sh, bash) spawning network tools, package managers, or curl/wget.
  • Outbound connections from the repo-server pod to hosts that are not configured Git, Helm, or OCI endpoints.
  • Audit log entries showing repository create or update API calls originating from accounts that normally do not manage repositories.

Detection Strategies

  • Inspect Kubernetes audit logs for argoproj.io repository and repocreds resources and flag any proxy value failing a strict URL allowlist.
  • Monitor process trees inside the argocd-repo-server pod and alert on any non-git child process launched under an SSH operation.
  • Correlate Argo CD API audit events with repo-server egress telemetry to surface new destinations introduced by recently modified repositories.

Monitoring Recommendations

  • Enable Kubernetes audit logging at the RequestResponse level for Argo CD custom resources and forward logs to a central SIEM.
  • Baseline normal repo-server network destinations and process behavior, then alert on deviations.
  • Review all existing repository and repocreds objects for malformed proxy fields as a one-time hunt.

How to Mitigate CVE-2026-55797

Immediate Actions Required

  • Upgrade Argo CD to version 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later as applicable to your release train.
  • Audit all repository and repository credential template objects and remove any entry with suspicious proxy values.
  • Rotate Git, Helm, and OCI credentials stored in Argo CD if unauthorized repository modifications are suspected.
  • Restrict RBAC so that only trusted principals hold repositories and repocreds create or update permissions.

Patch Information

The maintainers released fixes in Argo CD v3.3.15, v3.4.10, v3.5.4, and v3.6.0-rc2. Technical details are documented in Security Advisory GHSA-j6cw-g6p4-7hch and implemented in commit 1e3ddd0 and commit 9b27aeb. The fix routes SSH proxying through connect-proxy and adds socks5 proxy support instead of concatenating proxy values into a shell command.

Workarounds

  • Remove the proxy field from all repository and repocreds objects until patching is complete.
  • Tighten Argo CD RBAC to restrict repositories, create and repositories, update actions to a minimal set of administrators.
  • Apply NetworkPolicy rules limiting the repo-server pod to only approved egress destinations.
bash
# Verify installed Argo CD version and upgrade via Helm
kubectl -n argocd get deploy argocd-repo-server \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

helm repo update
helm upgrade argocd argo/argo-cd --version <patched-chart-version> \
  --namespace argocd

# Hunt for repositories with suspicious proxy values
kubectl -n argocd get secrets -l argocd.argoproj.io/secret-type=repository \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.data.proxy}{"\n"}{end}'

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne