Cpe:2.3:a:argoproj:argo_cd_image_updater:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aargoprojargo_cd_image_updater/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 22:18:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArgo CD Image Updater: Command Injection in SSH Proxy URL (CVE-2026-121621)https://feed.craftedsignal.io/briefs/2026-11-argo-cd-image-updater-rce/Tue, 03 Nov 2026 22:18:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-argo-cd-image-updater-rce/Argo CD Image Updater fails to sanitize proxy URL inputs for SSH Git repositories, allowing attackers to perform command injection and execute arbitrary code within the service process.CVE-2026-121621 is a command injection vulnerability in Argo CD Image Updater. The vulnerability exists because proxy URLs configured for SSH-based Git repositories are passed to shell-interpreted SSH commands without adequate sanitization. An attacker with the ability to modify the proxy configuration can inject shell metacharacters to execute arbitrary commands with the privileges of the Image Updater process.

Impact

Successful exploitation allows for arbitrary code execution in the context of the Argo CD Image Updater process. This provides the attacker the ability to access service credentials stored by the Image Updater, potentially leading to broader compromise of the Argo CD environment.

Recommendation

  • Update Argo CD Image Updater to a version containing the patch for CVE-2026-121621 as soon as released.
  • Audit existing Argo CD Image Updater configurations for any suspicious proxy settings, particularly those utilizing shell metacharacters (e.g., ;, |, &, $, etc.).
  • Restrict access to the configuration interfaces of Argo CD Image Updater to prevent unauthorized modification of repository proxy settings.
]]>highadvisory