Argo CD Image Updater: Command Injection in SSH Proxy URL (CVE-2026-121621)
Argo CD Image Updater fails to sanitize proxy URL inputs for SSH Git repositories, allowing attackers to perform command injection and execute arbitrary code within the service process.
CVE search metadata
CVE search record: CVE-2026-121621. Severity: high. CVSS: 8.8. KEV: no. Product: Argo CD Image Updater. Brief: Argo CD Image Updater: Command Injection in SSH Proxy URL (CVE-2026-121621). Brief link: https://feed.craftedsignal.io/briefs/2026-11-argo-cd-image-updater-rce/
Triage facts
Revision 2- Applicability
- Argo CD Image Updater
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 4, 00:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
CVE-2026-121621 is a command injection vulnerability in Argo CD Image Updater. The vulnerability exists because proxy URLs configured for SSH-based Git repositories are passed to shell-interpreted SSH commands without adequate sanitization. An attacker with the ability to modify the proxy configuration can inject shell metacharacters to execute arbitrary commands with the privileges of the Image Updater process.
Impact
Successful exploitation allows for arbitrary code execution in the context of the Argo CD Image Updater process. This provides the attacker the ability to access service credentials stored by the Image Updater, potentially leading to broader compromise of the Argo CD environment.
Recommendation
- Update Argo CD Image Updater to a version containing the patch for CVE-2026-121621 as soon as released.
- Audit existing Argo CD Image Updater configurations for any suspicious proxy settings, particularly those utilizing shell metacharacters (e.g., ;, |, &, $, etc.).
- Restrict access to the configuration interfaces of Argo CD Image Updater to prevent unauthorized modification of repository proxy settings.
Immediate actions
Audit and restrict access to Argo CD Image Updater configuration interfaces to prevent unauthorized changes to repository proxy settings.
Threat Hunt
Search for Argo CD Image Updater configuration logs or audit trails indicating modifications to SSH proxy URL settings containing shell metacharacters.
Data: Argo CD configuration logs, Audit logs
Mitigations
Monitor for official patched releases of Argo CD Image Updater and deploy to all production clusters immediately upon availability.
CVE-2026-121621