Homepage

OS Command Injection Affecting argocd-operator package, versions <0.18.0-r4

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
1.55% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-ARGOCDOPERATOR-20935701
  • published14 Oct 2026
  • disclosed9 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 9 Oct 2026

NewCVE-2026-55797  (opens in a new tab)
CWE-78  (opens in a new tab)

How to fix?

Upgrade Chainguard argocd-operator to version 0.18.0-r4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream argocd-operator package and not the argocd-operator package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.