CVE-2026-121621— Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

Quick assessment

Affected

Red Hat Red Hat OpenShift GitOps

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Argo CD Image Updater 中发现了一个命令注入漏洞：当 SSH Git 仓库配置了代理 URL 时，该 URL 未经净化即被传入由 Shell 解释的 SSH 命令中。能够设置恶意代理值的攻击者可以注入 Shell 元字符，从而在 Image Updater 进程的上下文中执行任意命令并访问凭证。

CVSS 8.8 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

Source: CVE Program / CVE List V5

Vulnerability Description

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat OpenShift GitOps	-	`cpe:/a:redhat:openshift_gitops:1`
Red Hat	Red Hat OpenShift GitOps	-	`cpe:/a:redhat:openshift_gitops:1`

II. Public POCs for CVE-2026-121621

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121621

请登录查看更多情报信息。

Other References for CVE-2026-121621 (3)

https://github.com/argoproj-labs/argocd-image-updater/pull/1905
https://access.redhat.com/security/cve/CVE-2026-121621 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2565914 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-121621

Same Patch Batch · Red Hat · 2026-11-03 · 7 CVEs total

CVE-2026-120830	7.4 HIGH	Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information
CVE-2026-82976	7.1 HIGH	Image-customization-controller: unauthenticated plaintext image server with directory list
CVE-2026-121259	6.5 MEDIUM	Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 deci
CVE-2026-119843	6.5 MEDIUM	Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/
CVE-2026-120831	6.5 MEDIUM	Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
CVE-2026-120971	5.3 MEDIUM	Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default excepti

IV. Related Vulnerabilities

Same product: Red Hat OpenShift GitOps

Same vendor: Red Hat

Same weakness: CWE-78