Argo CD CVE-2026-55797

Requires (1) a Git repository configured to use SSH, and (2) a proxy URL (http, https, socks5, or socks5h all take this path for SSH repos) whose host contains shell metacharacters. The attacker must be able to set that proxy, meaning they hold repository create/update rights via a project-scoped repository permission, 'argocd repo add --proxy', or write access to a repository Secret / credential template; a credential template's proxy applies to every matching SSH repo lacking its own credentials. The command fires when Argo CD tests the repository connection and on subsequent fetches. LIMITING FACTORS: not exploitable by fully unauthenticated/anonymous users (PR:L - needs delegated repository or credential-template write privilege), does not apply to HTTPS Git repositories (which use the proxy as an HTTP proxy and never build the ProxyCommand), and only affects v2.11.0 onward (v2.10.20 and earlier are not vulnerable). No end-user interaction is required once the malicious proxy is stored.

This is a genuine high-priority issue for organizations running Argo CD, though not a mass-internet threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and the CWE-78 classification are internally consistent with the description: a network-reachable attacker with low-level privileges (the ability to create/update a repository or credential template) can inject OS commands into the repo-server with no user interaction. The C:H/I:H/A:H impact is well-supported - the repo-server process can read other Git, Helm, and OCI credentials, giving a path from a single project-scoped repository permission to broad credential theft and code execution, effectively a privilege-escalation/lateral-movement primitive inside the cluster. Signals partially conflict on exposure, however: it is NOT in CISA KEV and no public exploit was provided in the input, so this is 'no public exploit identified at time of analysis' rather than active exploitation - the 8.8 score reflects potential impact, not observed in-the-wild use. The critical limiting factor, which the raw score obscures, is PR:L: exploitation requires a pre-existing privileged position (repository write or credential-template management), so realistic risk concentrates in multi-tenant Argo CD deployments where repository permissions are delegated to less-trusted users. EPSS was not provided in the input and cannot be assessed. Patch availability is confirmed by the vendor, which should drive prompt remediation given the credential-exposure impact.

A user holding project-scoped repository permissions in a multi-tenant Argo CD instance adds or updates an SSH Git repository (or a matching credential template) and sets its proxy field to a value whose host contains shell metacharacters. When Argo CD tests the connection or later fetches the repo, the repo-server builds an SSH ProxyCommand and executes the injected command, running attacker-controlled code that can exfiltrate other tenants' stored Git, Helm, and OCI credentials. No public exploit code was identified at time of analysis, but the technique is straightforward given the documented ProxyCommand string-building flaw.