Red Hat OpenShift GitOps · Vulnerability
Historical advisory recorded 4 Nov 2026 21:54:02 UTC. Read the latest advisory.
cve-program · CVE-2026-121621
PublishedA command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-121621
PublishedGithub.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration
A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.
- Source published
- 3 Nov 2026 21:00:53 UTC
- Source modified
- 4 Nov 2026 20:00:59 UTC
- Saved here
- 4 Nov 2026 21:54:02 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H