Vulnerability · Published Nov 3, 2026 · Assigned by redhat

CVE-2026-121621Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

High 8.8

In plain English

A high-severity OS command injection in Red Hat OpenShift GitOps from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.8%top 21.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift GitOps	see references
Red Hat	Red Hat OpenShift GitOps	see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-121621 vdb-entry, x_refsource_REDHAT
RHBZ#2565914 issue-tracking, x_refsource_REDHAT
https://github.com/argoproj-labs/argocd-image-updater/pull/1905