CVE-2025-59531
published 2025-10-01CVE-2025-59531: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
41.7th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | 1.2.0 – 1.8.7 | — |
| argoproj | argo_cd | >= 2.0.0 < 2.14.20 | 2.14.20 |
| argoproj | argo_cd | >= 3.0.0 < 3.0.19 | 3.0.19 |
| argoproj | argo_cd | >= 3.1.0 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd | 1.2.0 – 1.8.7 | — |
| github.com | argoproj_argo-cd | >= 1.2.0 | — |
| github.com | argoproj_argo-cd_v2 | >= 2.0.0-rc1 < 2.14.20 | 2.14.20 |
| github.com | argoproj_argo-cd_v3 | >= 3.0.0-rc1 < 3.0.19 | 3.0.19 |
| github.com | argoproj_argo-cd_v3 | >= 3.1.0-rc1 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd_v3 | >= 3.2.0-rc1 < 3.2.0-rc2 | 3.2.0-rc2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
vendor_redhat·2025-10-01·CVSS 7.5
CVE-2025-59531 [HIGH] CWE-248 argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
A denial o
OSV
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
osv·2025-10-23
CVE-2025-59531 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
GHSA
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
ghsa·2025-09-30
CVE-2025-59531 [HIGH] CWE-703 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
### Summary
Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.
With the default configuration, no `webhook.bitbucketserver.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Bitbucket-Server push event whose JSON field `repository.links.clone` is anything other than an array.
A single unauthenticated curl request can push the control-plane into CrashLoopBackOff; repeating the request on each replica causes a complete outage of the API.
### Details
```go
// webhook.go (Bitbucket-Server branch in affectedRevisionInfo)
for _, l := range payload.Repos
OSV
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
osv·2025-09-30
CVE-2025-59531 [HIGH] Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
### Summary
Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.
With the default configuration, no `webhook.bitbucketserver.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Bitbucket-Server push event whose JSON field `repository.links.clone` is anything other than an array.
A single unauthenticated curl request can push the control-plane into CrashLoopBackOff; repeating the request on each replica causes a complete outage of the API.
### Details
```go
// webhook.go (Bitbucket-Server branch in affectedRevisionInfo)
for _, l := range payload.Repos
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-01
Published