{"id":"EUVD-2026-95912","revision":"e768ac3a23494b679a312d4fe8bc0991","records":[{"revision":"e768ac3a23494b679a312d4fe8bc0991","observedAt":"2026-11-07T12:34:17.665+00:00","statement":{"source":"euvd","id":"EUVD-2026-95912","aliases":["CVE-2026-55797","GHSA-j6cw-g6p4-7hch"],"title":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git reposi…","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":null}],"references":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch","https://github.com/argoproj/argo-cd/pull/15864","https://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f","https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205","https://github.com/argoproj/argo-cd/releases/tag/v3.3.15","https://github.com/argoproj/argo-cd/releases/tag/v3.4.10","https://github.com/argoproj/argo-cd/releases/tag/v3.5.4","https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95912","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 9, 2026, 4:43:35 PM","dateUpdated":"Oct 9, 2026, 5:53:53 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90323","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.9 security update","vulnerabilityIds":["CVE-2026-71556"]},{"id":"RHSA-2026:77269","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.5 security update","vulnerabilityIds":["CVE-2025-61560","CVE-2026-33818","CVE-2026-41178","CVE-2026-50162","CVE-2026-55797","CVE-2026-56852","CVE-2026-56854","CVE-2026-77459"]},{"id":"RHSA-2026:90337","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.6 security update","vulnerabilityIds":["CVE-2026-71556","CVE-2026-84375"]},{"id":"RHSA-2026:77267","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.22.1 security update","vulnerabilityIds":["CVE-2025-61560","CVE-2026-33818","CVE-2026-55797","CVE-2026-77459"]},{"id":"RHSA-2026:77273","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.8 security update","vulnerabilityIds":["CVE-2025-61560","CVE-2026-33818","CVE-2026-50162","CVE-2026-55797","CVE-2026-56852","CVE-2026-56853","CVE-2026-56854","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-77459"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95912","identifiers":["EUVD-2026-95912","CVE-2026-55797","GHSA-j6cw-g6p4-7hch"]},"retained":false,"historicalAffected":[]}],"coverage":[]}