CVE-2026-55797

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

• CWE-78

• https://github.com/argoproj/argo-cd/commit/1e3ddd0b7250aa23f489956b5fab8c13d0493a9f
• https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205
• https://github.com/argoproj/argo-cd/pull/15864
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.15
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.10
• https://github.com/argoproj/argo-cd/releases/tag/v3.5.4
• https://github.com/argoproj/argo-cd/releases/tag/v3.6.0-rc2
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55791Craft CMS is a content management system (CMS). Versions 4.0…6.9
• CVE-2026-55792Craft CMS is a content management system (CMS). In versions …6
• CVE-2026-55793Craft CMS is a content management system (CMS). In versions …5.9
• CVE-2026-55794Craft CMS is a content management system (CMS). In versions …8.7
• CVE-2026-55795Craft Commerce is an ecommerce platform for Craft CMS. From …6.9
• CVE-2026-55796Frappe HR is an open-source human resources management solut…6.5
• CVE-2026-55798Pillow is a Python imaging library. Prior to 12.3.0, Windows…4.5
• CVE-2026-55799Remote Code Execution Vulnerability in GraalScriptEngineCrea…9.8
• CVE-2026-5580A vulnerability was identified in CodeAstro Online Classroom…6.3
• CVE-2026-55803Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-55804Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-55805Improper Neutralization of Input During Web Page Generation …5.4