Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Argo CD repo server can execute unwanted commands

CVE-2026-55797 · published 16 days ago
Summary

The repo-server part of Argo CD can be fooled by a specially crafted SSH repository address that includes a SOCKS5 proxy setting. This could let an attacker run any command on the server, potentially stealing data or taking control. Apply the latest Argo CD updates and only use trusted repository URLs to protect against this risk.

What to do
  • Update github.com argoproj to version 3.3.15.
  • Update github.com argoproj to version 3.4.10.
  • Update github.com argoproj to version 3.5.4.
  • Update github.com argoproj to version 3.6.0-rc2.
  • Update argo-cd to version 3.5.4.
  • Update argoproj github.com/argoproj/argo-cd/v3 to version 3.3.15.
  • Update argoproj github.com/argoproj/argo-cd/v3 to version 3.4.10.
  • Update argoproj github.com/argoproj/argo-cd/v3 to version 3.5.4.
  • Update argoproj github.com/argoproj/argo-cd/v3 to version 3.6.0-rc2.
Affected software
Ecosystem VendorProductAffected versions
– argoproj argo-cd >= 2.11.0, <= 2.14.21
go github.com argoproj >= 2.11.0, <= 2.14.21
go github.com argoproj >= 3.0.0, < 3.3.15
>= 3.4.0, < 3.4.10
>= 3.5.0, < 3.5.4
3.6.0-rc1
Fix: upgrade to 3.3.15
Bitnami – argo-cd >= 3.5.0, < 3.5.4
Fix: upgrade to 3.5.4
Go argoproj github.com/argoproj/argo-cd/v2 >= 2.11.0, <= 2.14.21
>= 2.11.0
Go argoproj github.com/argoproj/argo-cd/v3 >= 3.0.0, < 3.3.15
>= 3.4.0, < 3.4.10
>= 3.5.0, < 3.5.4
>= 3.6.0-rc1, < 3.6.0-rc2
Fix: upgrade to 3.3.15
Go argoproj github.com/argoproj/argo-cd All versions
Original advisory text
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published19 Oct 2026
Updated30 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-55797 · NVD
CVE-2026-55797 · MITRE
GHSA-j6cw-g6p4-7hch · GHSA
CVE-2026-55797 · OSV
GO-2026-6701 · OSV
GHSA-j6cw-g6p4-7hch · OSV
BIT-argo-cd-2026-55797 · OSV
Track software like this
Free during beta