Argo CD 3.6.0-rc3 Addresses Critical Command Injection Vulnerability, Urges Immediate Upgrade for Older Versions

A high-severity command injection vulnerability, identified as CVE-2026-55797 with a CVSS score of 8.8, has been discovered in the Argo CD repo-server component. This flaw allows an attacker to execute arbitrary commands on the repo-server by crafting a malicious SSH Git repository proxy URL. The vulnerability arises because the repo-server builds an SSH ProxyCommand through a shell without properly neutralizing shell metacharacters in the proxy host and port. This means that anyone with the ability to create or update a repository or repository credential template can exploit this to run arbitrary commands. This vulnerability is particularly significant for organizations utilizing Argo CD in multi-tenant environments, as an attacker could potentially read other Git, Helm, and OCI credentials stored on the repo-server, leading to credential harvesting across teams. The immediate impact for practitioners is the urgent need to upgrade their Argo CD instances. The fix for this vulnerability involves preventing the proxy host and port from being passed through a shell. This incident underscores a broader, well-established trend in cloud-native security: the continuous need for vigilance and timely patching of critical infrastructure components. As GitOps becomes increasingly prevalent for managing Kubernetes deployments, tools like Argo CD become central to an organization's operational security posture. The concentration of access and secrets within such tools makes them attractive targets for attackers. Previous vulnerabilities in Argo CD, such as CVE-2025-55190 (credential exposure) and CVE-2026-42880 (plaintext secret exposure), further illustrate this pattern, emphasizing that internal surfaces of these tools often present attack vectors. In practice, this means DevOps and platform engineering teams must prioritize security updates as a fundamental part of their GitOps strategy. For those running unsupported versions of Argo CD (2.x and 3.0-3.2), an upgrade to a patched release (3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or newer) is not optional; it's the only way to mitigate this specific risk. Beyond immediate patching, organizations should also review their access control policies for repository creation and updates, and consider implementing network segmentation to limit the blast radius of any potential compromise. Regularly auditing and updating dependencies within their GitOps toolchain is crucial for maintaining a robust security posture in the face of evolving threats.