CVE-2025-59537
published 2025-10-01CVE-2025-59537: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.56%
42.5th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | 1.2.0 – 1.8.7 | — |
| argoproj | argo_cd | >= 2.0.0 < 2.14.20 | 2.14.20 |
| argoproj | argo_cd | >= 3.0.0 < 3.0.19 | 3.0.19 |
| argoproj | argo_cd | >= 3.1.0 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd | 1.2.0 – 1.8.7 | — |
| github.com | argoproj_argo-cd | >= 1.2.0 | — |
| github.com | argoproj_argo-cd_v2 | >= 2.0.0-rc1 < 2.14.20 | 2.14.20 |
| github.com | argoproj_argo-cd_v3 | >= 3.0.0-rc1 < 3.0.19 | 3.0.19 |
| github.com | argoproj_argo-cd_v3 | >= 3.1.0-rc1 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd_v3 | >= 3.2.0-rc1 < 3.2.0-rc2 | 3.2.0-rc2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service
vendor_redhat·2025-10-01·CVSS 7.5
CVE-2025-59537 [HIGH] CWE-476 github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service
github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
A denial of service flaw has been discovered in Argo-CD. With the default configuration, no `webhook.gogs.secret` set, Argo CD’s /a
OSV
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
osv·2025-10-23
CVE-2025-59537 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
GHSA
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
ghsa·2025-09-30
CVE-2025-59537 [HIGH] CWE-20 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
### Summary
Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.
With the default configuration, no `webhook.gogs.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field `commits[].repo` is not set or is null.
### Details
Users can access `/api/webhook` without authentication, and when accessing this endpoint, the `Handler` function parses webhook type messages according to the `header (e.g. X-Gogs-Event)` and `body` parameters provided by the user. The `Parse` function simply unmarshals JSON-type messages. In other words, it returns
OSV
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
osv·2025-09-30
CVE-2025-59537 [HIGH] argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
### Summary
Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.
With the default configuration, no `webhook.gogs.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field `commits[].repo` is not set or is null.
### Details
Users can access `/api/webhook` without authentication, and when accessing this endpoint, the `Handler` function parses webhook type messages according to the `header (e.g. X-Gogs-Event)` and `body` parameters provided by the user. The `Parse` function simply unmarshals JSON-type messages. In other words, it returns
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-01
Published