CVE-2026-55797highCWE-78

CVE-2026-55797: falha de alta gravidade em argoproj argo-cd

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Publicada em 09 out 2026

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.5%

probabilidade de exploração

1.5%top 26% das CVEs

exploração observada

nãonenhuma fonte reporta

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

argoproj · argo-cd

CVEs relacionadas — argoproj argo-cd

No mesmo produto, das mais perigosas para as menos.

CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.9%CVE-2025-55190CRITICALArgo CD: Project API Token Exposes Repository CredentialsEPSS 5.5%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%CVE-2023-40584MEDIUMDenial of Service to Argo CD repo-server EPSS 1.4%

Referências