CVE-2026-55797: Argo CD Command Injection Vulnerability via SSH Repository SOCKS5 Proxy URL
Summary
CVE-2026-55797: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL. Affects github.com/argoproj/argo-cd/v2 versions >= 2.11.0, <= 2.14.21. No fix is published. How to fix ↓
Also tracked for
- github.com/argoproj/argo-cd · Go
- argo-cd · Bitnami
The same CVE-2026-55797 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is a declarative continuous delivery tool for Kubernetes that enables users to manage their applications using Git repositories. It supports various repository types, including Git, Helm, and OCI, and allows for seamless integration with Kubernetes clusters. The tool is designed to automate deployment processes and provide visibility into application states. However, a recent vulnerability has been identified that affects versions 2.11.0 and onward, allowing for potential command injection through crafted SSH repository SOCKS5 proxy URLs.
Vulnerability Detail
The vulnerability arises from Argo CD's handling of SSH Git repositories with proxy URLs. When cloning or fetching a repository, Argo CD runs a shell command that incorporates the proxy host and port into an SSH ProxyCommand. If an attacker can control the proxy URL, they can inject shell metacharacters, leading to command execution in the repo-server context. This can expose sensitive credentials and allow unauthorized access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, do not grant repository create or update permissions to untrusted users. Additionally, avoid setting a proxy on SSH repositories or credential templates that match SSH repositories. Review existing repository and credential-template Secrets for unexpected proxy values.
Conclusion
The command injection vulnerability in Argo CD via crafted SSH repository SOCKS5 proxy URLs poses a significant risk to users of versions 2.11.0 and onward. It is crucial to upgrade to a patched version or implement strict access controls to mitigate potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
All versions from v2.11.0 onward are affected, including every currently supported release. Versions v2.10.20 and earlier are not affected.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Yes, HTTPS Git repositories with an HTTP proxy do not use the vulnerable command, thus are not affected by this issue.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring signup.
If upgrading is not possible, ensure that untrusted users do not have repository create or update permissions and avoid using proxy settings on SSH repositories.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
