{"id":"EUVD-2026-95912","enisaUuid":"77c1d55a-dd6f-31eb-8e5c-992b49d4fa00","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","datePublished":"Oct 9, 2026, 4:43:35 PM","dateUpdated":"Oct 9, 2026, 5:53:53 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch\nhttps://github.com/argoproj/argo-cd/pull/15864\nhttps://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f\nhttps://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.3.15\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.4.10\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.5.4\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2\n","aliases":"CVE-2026-55797\nGHSA-j6cw-g6p4-7hch\n","assigner":"GitHub_M","epss":1.87,"enisaIdProduct":[{"id":"2e21b82b-a6c6-38cc-9c87-bcf30bdfc49b","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.5.0, \u003c 3.5.4"},{"id":"a1f8d464-52de-3819-8550-99ff81ee3a83","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.0.0, \u003c 3.3.15"},{"id":"a6900e84-9116-3498-96c6-803105089839","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.11.0, ≤ 2.14.21"},{"id":"b6a1a8bb-feb8-391e-bb2e-afe95c1c731e","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"\u003d 3.6.0-rc1"},{"id":"f239f99a-1d34-37bc-b162-95e9b6867bed","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.4.0, \u003c 3.4.10"}],"enisaIdVendor":[{"id":"82211db4-d242-32a4-9924-8e513aa76d12","vendor":{"name":"argoproj"}}],"enisaIdVulnerability":[{"id":"3309be77-ed56-3eb5-9142-29e085b73981","vulnerability":{"id":"GHSA-j6cw-g6p4-7hch","description":"Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL","datePublished":"Oct 9, 2026, 4:37:24 PM","dateUpdated":"Oct 9, 2026, 4:37:25 PM","baseScore":0.0,"references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch\nhttps://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f\nhttps://github.com/argoproj/argo-cd\n","enisa_id":"EUVD-2026-95912\n","aliases":"GHSA-j6cw-g6p4-7hch\nCVE-2026-55797\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"68cfad84-e7cd-362c-9796-72d8da2d72e2","vulnerability":{"id":"CVE-2026-55797","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","datePublished":"Oct 9, 2026, 4:43:35 PM","dateUpdated":"Oct 9, 2026, 5:53:53 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch\nhttps://github.com/argoproj/argo-cd/pull/15864\nhttps://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f\nhttps://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.3.15\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.4.10\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.5.4\nhttps://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2\n","enisa_id":"EUVD-2026-95912\n","assigner":"GitHub_M","epss":1.87,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"1381b1ae-4834-3ad8-a382-2b074072980b","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"2.11.0, ≤ 2.14.21"},{"id":"253e3498-9169-3ed3-9e19-d0fb38c2d719","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"\u003d 3.6.0-rc1"},{"id":"afb6e973-044e-3383-927e-df6014593413","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.0.0, \u003c 3.3.15"},{"id":"b2b2d79f-d691-309e-9b55-b2cf38cab66c","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.4.0, \u003c 3.4.10"},{"id":"e3349fc0-d47a-3192-a612-46b2ac0359ff","product":{"name":"argo-cd","vendor":{"name":"argoproj"}},"product_version":"3.5.0, \u003c 3.5.4"}],"vulnerabilityVendor":[{"id":"acef572e-9eaa-3872-ace4-2781b944e1c4","vendor":{"name":"argoproj"}}]}}],"enisaIdAdvisory":[]}