CVE-2025-59538
published 2025-10-01CVE-2025-59538: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
41.7th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | — | — |
| argoproj | argo_cd | >= 2.9.0 < 2.14.20 | 2.14.20 |
| argoproj | argo_cd | >= 3.0.0 < 3.0.19 | 3.0.19 |
| argoproj | argo_cd | >= 3.1.0 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd_v2 | >= 2.9.0-rc1 < 2.14.20 | 2.14.20 |
| github.com | argoproj_argo-cd_v3 | >= 3.0.0-rc1 < 3.0.19 | 3.0.19 |
| github.com | argoproj_argo-cd_v3 | >= 3.1.0-rc1 < 3.1.8 | 3.1.8 |
| github.com | argoproj_argo-cd_v3 | >= 3.2.0-rc1 < 3.2.0-rc2 | 3.2.0-rc2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
osv·2025-10-23
CVE-2025-59538 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
GHSA
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
ghsa·2025-09-30
CVE-2025-59538 [HIGH] CWE-248 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
### Summary
In the default configuration, `webhook.azuredevops.username` and `webhook.azuredevops.password` not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty.
The slice index [0] is accessed without a length check, causing an index-out-of-range panic.
A single unauthenticated HTTP POST is enough to kill the process.
### Details
```go
case azuredevops.GitPushEvent:
// util/webhook/webhook.go -- line ≈147
revision = ParseRevision(payload.Resource.RefUpdates[0].Name) // panics if slice empty
change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID)
change.shaBefore= Parse
OSV
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
osv·2025-09-30
CVE-2025-59538 [HIGH] Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
### Summary
In the default configuration, `webhook.azuredevops.username` and `webhook.azuredevops.password` not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty.
The slice index [0] is accessed without a length check, causing an index-out-of-range panic.
A single unauthenticated HTTP POST is enough to kill the process.
### Details
```go
case azuredevops.GitPushEvent:
// util/webhook/webhook.go -- line ≈147
revision = ParseRevision(payload.Resource.RefUpdates[0].Name) // panics if slice empty
change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID)
change.shaBefore= Parse
Red Hat
github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service
vendor_redhat·2025-10-01·CVSS 7.5
CVE-2025-59538 [HIGH] CWE-617 github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service
github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
A denial of service flaw has been discovered in Argo-CD.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-01
Published