Advisory · CVE-2026-121621
Argo CD Image Updater command injection via SSH proxy URL
Argo CD Image Updater passes a proxy URL configured on an SSH Git repository unsanitized into a shell-interpreted SSH command, so a user able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the Image Updater process.
- Vendor
- Argo
- Product
- Argo CD Image Updater
- Identifier / CWE
- CVE-2026-121621
CWE-78 - Action timing
- Immediate
Explain it like I’m five
The updater builds its secure-connection command by pasting the proxy address straight into a shell sentence. A proxy address containing shell punctuation ends that sentence early and starts a new one of the attackers choosing, running inside the updater with its keys in reach.
- 01Malicious proxy configured
A user able to create or update an SSH Git repository or a repository credential template sets a proxy URL containing shell metacharacters.
- 02SSH command built
When the Image Updater performs a Git operation for that repository, it builds a shell-interpreted SSH command embedding the proxy value.
- 03Metacharacters break out
The shell interprets the injected metacharacters as command separators, escaping the intended proxy command.
- 04Commands run with credentials
The injected commands execute in the Image Updater process context, where its Git, Helm, and OCI credentials are accessible.
What happened
Argo CD Image Updater contains a command injection vulnerability in its handling of proxy URLs on SSH Git repositories. A proxy URL configured on such a repository is passed unsanitized into a shell-interpreted SSH command, so an attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process. The Red Hat record, which tracks the issue for OpenShift GitOps packaging of the component, rates it high at CVSS 8.8. The same proxy-injection pattern was fixed in Argo CD itself in its October 2026 coordinated release, and the upstream Image Updater fix is tracked in pull request 1905, which validates proxy URLs and routes SSH proxy handling through a temporary wrapper script instead of a shell string.
No fixed release was stated in the sources checked for this run, so no fixed version is claimed here; the pull request is the fix reference to watch for a release that includes it. The precondition is a real permission boundary, not an anonymous trigger: the attacker needs the ability to set a repository or credential-template proxy, which project-scoped repository permissions can grant. That makes this a privilege-escalation path from repository configuration into the credential-holding GitOps component, not a low-severity configuration quirk.
What to do
- Inventory Argo CD Image Updater deployments, including those shipped inside OpenShift GitOps, and audit every SSH repository and credential template for proxy values.
- Remove any proxy value containing shell metacharacters or otherwise outside a strict allowlist, and restrict who can create or update repositories and credential templates.
- Apply the upstream fix as soon as a release containing pull request 1905 is available, and verify the deployed version.
- Review Image Updater and Git operation logs for unusual proxy values and for commands or credential access outside normal synchronization.
- Rotate Git, Helm, and OCI credentials held by any Image Updater instance where a suspicious proxy value cannot be excluded.
Management note
GitOps components hold the keys to the cluster, so a configuration field that reaches a shell is a credential-theft path, not a cosmetic bug. Audit the proxy values now: the fix is upstream, but the exposure is whatever is already configured.