Argo CD repo-server: shell metacharacters in a repository proxy URL run commands and leak Git/Helm/OCI credentials

Impact

The repo-server builds an SSH ProxyCommand from a repository's configured proxy host and port and runs it through a shell without neutralizing metacharacters, so a crafted proxy host executes arbitrary commands inside the repo-server. The repo-server holds the credentials for every Git, Helm and OCI source the cluster deploys from, so this converts the ability to add or edit one repository into read access to the deployment credentials for all of them. On a GPU fleet that is the component that renders the manifests for the GPU Operator, device plugin, scheduler and tenant workloads, so credential theft or manifest tampering here reaches every node without touching a node directly. Affects 2.11.0 up to the fixed releases.

Who can reach it

Any authenticated Argo CD user (or service account) with permission to create or update a repository or a repository credential template - over the network, no cluster access required.

What to do

Upgrade Argo CD to 3.3.15, 3.4.10, 3.5.4 or 3.6.0-rc2 and restart the repo-server deployment; this is a control-plane rollout, not a node operation, so no GPU node drain is needed. Until then, restrict who holds repository create/update RBAC and audit existing repository configurations for proxy URLs containing shell metacharacters.

References

Related entries

• Rancher: plaintext non-expiring registration tokens let an attacker join a rogue node to a clusterCVE-2026-55997 · Rancher (downstream cluster registration tokens)High
• Portainer CE: non-canonical URL path defeats Docker proxy authorization, granting root on the Docker hostCVE-2026-72533 · Portainer CE (Docker API proxy authorization middleware)High
• Dokploy: WebSocket handlers skip per-server authorization, giving any org member root terminalsCVE-2026-72883 · Dokploy (WebSocket terminal, container-terminal, logs and stats handlers)High
• OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build podsCVE-2026-73667 · OpenChoreo Workflow Plane (sample workflow templates, sh -c parameter interpolation)High
• OpenChoreo API: project-scoped users can exec into and read wirelogs of other projects' componentsCVE-2026-73841 · OpenChoreo openchoreo-api (component exec and wirelogs handlers)High
• KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade resultsCVE-2026-82473 · KubeEdge CloudCore (CloudHub HTTPS server, node task status endpoints)High