StackRadar

CVE-2026-55797

High

Advisory

Published 9 Oct 2026In the index since 10 Oct 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 18,087 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 2
affected packages

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Carried by container images the latest versions of 29 of 18,087 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
github.com/argoproj/argo-cd/v3golangv3.0.3, v3.0.5, v3.1.1, v3.2.12+6 more3.3.15, 3.5.412
github.com/argoproj/argo-cd/v2golangv2.11.5, v2.13.3, v2.14.9, v2.14.11+1 moreno fix listed9
OSV records
GHSA-j6cw-g6p4-7hch

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
argocd-image-updaterargoOfficialVerified publisher1.3.11 of 1See more

argocd-image-updater argo 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4

Open the chart page →

1,167
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.3.15

Open the chart page →

7,168
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

41,631
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.3.15

Open the chart page →

1,372
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

2,179
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

2,179
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.3.15

Open the chart page →

14,455
alustan-helmalustan-helm1.0.01 of 1See more

alustan-helm alustan-helm 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
alustan/install-argocd:1.0.0c16c34f46ad3
github.com/argoproj/argo-cd/v2@v2.11.5
no fix listed

Open the chart page →

2,449
fargocdappscodeVerified publisher2026.9.181 of 1See more

fargocd appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15

Open the chart page →

653
fargocd-managerappscodeVerified publisher2026.9.181 of 1See more

fargocd-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15

Open the chart page →

653
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

9,972
capsule-argo-addoncapsule-argo-addonVerified publisher0.8.01 of 2See more

capsule-argo-addon capsule-argo-addon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.8.064b8c5389b33
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4

Open the chart page →

1,753
argo-cdcluster-deploy0.3.32 of 3See more

argo-cd cluster-deploy 0.3.3

2 of the 3 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
github.com/argoproj/argo-cd/v3@v3.5.3+dirty
3.5.4
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4

Open the chart page →

3,564
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

87,451
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

87,451
devtron-operatordevtron-labs0.23.31 of 11See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

41,631
cd-pipeline-operatorepmdedpVerified publisher2.32.01 of 1See more

cd-pipeline-operator epmdedp 2.32.0

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
epamedp/cd-pipeline-operator:2.32.0fc858071b7a1
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15

Open the chart page →

360
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
epamedp/cd-pipeline-operator:2.32.0fc858071b7a1
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15

Open the chart page →

3,383
kubecheckskubechecks3.1.01 of 1See more

kubechecks kubechecks 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/zapier/kubechecks:latest65780f7c0ae9
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4

Open the chart page →

839
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed

Open the chart page →

1,842
argocd-agent-addonocm-helm-chartsVerified publisher0.30.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.30.0

1 of the 2 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15

Open the chart page →

1,083
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.15

Open the chart page →

755
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

31,528
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/argoproj/argo-cd/v3@v3.5.2+dirty
3.5.4

Open the chart page →

2,461
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

87,451
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

41,631
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

3,311
argocd-image-updaterwener1.3.11 of 1See more

argocd-image-updater wener 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4

Open the chart page →

1,167
argocd-image-updaterwenerme1.3.11 of 1See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-55797.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4

Open the chart page →

1,167

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
github.com/argoproj/argo-cd/v3@v3.5.1
3.5.4
4
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
epamedp/cd-pipeline-operator:2.32.0fc858071b7a1
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15
2
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/argoproj/argo-cd/v3@v3.2.12
3.3.15
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
2
alustan/install-argocd:1.0.0c16c34f46ad3
github.com/argoproj/argo-cd/v2@v2.11.5
no fix listed
1
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed
1
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.15
1
ghcr.io/peak-scale/capsule-argo-addon:0.8.064b8c5389b33
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4
1
ghcr.io/zapier/kubechecks:latest65780f7c0ae9
github.com/argoproj/argo-cd/v3@v3.5.3
3.5.4
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.3.15
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.3.15
1
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
github.com/argoproj/argo-cd/v3@v3.5.3+dirty
3.5.4
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
github.com/argoproj/argo-cd/v3@v3.3.10
3.3.15
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.3.15
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/argoproj/argo-cd/v3@v3.5.2+dirty
3.5.4
1

syft 1.42.1 · advisories as of 10 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.