Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

Summary

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

Remediation

1. Inventory every Red Hat Red Hat OpenShift GitOps deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://access.redhat.com/security/cve/CVE-2026-121621
• Referencehttps://bugzilla.redhat.com/show_bug.cgi?id=2565914
• Referencehttps://github.com/argoproj-labs/argocd-image-updater/pull/1905