CVE-2026-55797 · GHSA-j6cw-g6p4-7hch

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Risk score: 73/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 1.5%
Published: 9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SS…
Affected: github.com/argoproj/argo-cd/v2 (go) >= 2.11.0, <= 2.14.21; github.com/argoproj/argo-cd/v3 (go) >= 3.0.0, < 3.3.15; github.com/argoproj/argo-cd/v3 (go) >= 3.4.0, < 3.4.10; github.com/argoproj/argo-cd/v3 (go) >= 3.5.0, < 3.5.4
Fix: Upgrade github.com/argoproj/argo-cd/v3 to 3.3.15 or 3.4.10 or 3.5.4 or 3.6.0-rc2 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/argoproj/argo-cd/v2: Amber, patch this week. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include clus…

The flaws

CVE-2026-55797: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8 · EPSS 2%)
CVE-2026-77459: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (CVSS 9.9 · EPSS 1%)

The fix

Upgrade github.com/argoproj/argo-cd/v2: 3.3.15 · 3.4.10 · 3.5.4 · 3.6.0 or later on your release line

Who is exposed: github.com/argoproj/argo-cd/v2 (go) >= 2.10.0, <= 2.14.21; github.com/argoproj/argo-cd/v3 (go) >= 3.0.0, < 3.3.15; github.com/argoproj/argo-cd/v3 (go) >= 3.4.0, < 3.4.10; github.com/argoproj/argo-cd/v3 (go) >= 3.5.0, < 3.5.4

Where it stands

No known exploitation

Connects to

Same weakness: OS command injection (CWE-78). 308 other warnings in 30 days

Why it is Amber

CVSS 8.8 high
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/argoproj/argo-cd/v2	go	>= 2.11.0, <= 2.14.21	No fix yet
github.com/argoproj/argo-cd/v3	go	>= 3.0.0, < 3.3.15	3.3.15
github.com/argoproj/argo-cd/v3	go	>= 3.4.0, < 3.4.10	3.4.10
github.com/argoproj/argo-cd/v3	go	>= 3.5.0, < 3.5.4	3.5.4
github.com/argoproj/argo-cd/v3	go	= 3.6.0-rc1	3.6.0-rc2

References

Original description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Last activity 9 Oct 2026. Patch Forecast updates every hour.