Live › vulnerability › CVE-2026-121621
Argo CD Image Updater passes a proxy URL from an SSH Git repository configuration unsanitized into a shell-interpreted SSH command. An attacker who can set a malicious proxy value can inject shell metacharacters to run arbitrary commands and read credentials held by the Image Updater process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Argo CD Image Updater with Git write-back over SSH where a proxy value is set on the SSH repository are exposed. The attacker needs to be able to set that proxy value (low privileges, network access per the CVSS vector), and the commands run with the Image Updater process's access, including its credentials. Installations that use no SSH Git proxy, or where only trusted admins can edit repository settings, can skip it. Affected Image Updater versions are not stated in the sources I read.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| argocd-image-updater | vendor | unknown; fix merged in master after v1.4.0 (PR #1905) | – |
v1.5.0, so watch the releases pageproxy value, and remove any unexpected ones3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2v1.5.0); no released version confirmed yetEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121621")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.