CVE Feed

    Dashboard / CVE / CVE-2026-121621

    CVE-2026-121621

    A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

    Published:Nov 2, 2026
    Last Modified:Nov 3, 2026
    EPS:Nov 3, 2026
    EPSS Score:
    CVSS Score:8.8

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Gitops

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-114406 (CVSS 6.8) — The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages,…
    CVE-2026-14251 (CVSS 7.7) — A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource owner…
    CVE-2026-15416 (CVSS 8.9) — A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unau…
    CVE-2026-42880 (CVSS 9.6) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11…
    CVE-2026-6388 (CVSS 9.1) — A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or…
    CVE-2026-29063 (CVSS 8.7) — Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Pr…
    CVE-2025-13888 (CVSS 9.1) — A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the…
    CVE-2025-55190 (CVSS 9.9) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2…
    CVE-2025-11065 (CVSS 5.3) — A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.…
    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High