CVE-2025-59538: high-severity vulnerability in argoproj argo-cd
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 8.9%
exploitation probability
8.9%top 5% of all CVEs
observed exploitation
nono source reports it
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
argoproj · argo-cdRelated CVEs — argoproj argo-cd
In the same product, most dangerous first.
CVE-2025-55190CRITICALArgo CD: Project API Token Exposes Repository CredentialsEPSS 5.5%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%CVE-2023-40584MEDIUMDenial of Service to Argo CD repo-server EPSS 1.4%CVE-2024-40634HIGHArgo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook EndpointEPSS 1.4%