CVE-2026-121621

argocd-image-updater · Vulnerability

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-121621

Published

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-121621

Published

argocd-image-updater

https://github.com/argoproj-labs/argocd-image-updater

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.4.1",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "argocd-image-updater",
                    "collectionURL": "https://github.com/argoproj-labs/argocd-image-updater",
                    "defaultStatus": "unaffected"
                }

openshift-gitops-1/argocd-image-updater-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift GitOps",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-gitops-1/argocd-image-updater-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_gitops:1"
                    ]
                }

openshift-gitops-1/gitops-rhel9-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift GitOps",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-gitops-1/gitops-rhel9-operator",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_gitops:1"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON