CVE-2025-59538
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 9.4% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-248, CWE-703
- Published
- Modified
- Record from
- the NVD, synced
Affected
- argoproj:argo_cd
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gpx4-37g2-c8pv | Go | github.com/argoproj/argo-cd/v2 | >=2.9.0-rc1 <2.14.20 | 2.14.20 |
| GHSA-gpx4-37g2-c8pv | Go | github.com/argoproj/argo-cd/v3 | >=3.2.0-rc1 <3.2.0-rc2 | 3.2.0-rc2 |
| GHSA-gpx4-37g2-c8pv | Go | github.com/argoproj/argo-cd/v3 | >=3.1.0-rc1 <3.1.8 | 3.1.8 |
| GHSA-gpx4-37g2-c8pv | Go | github.com/argoproj/argo-cd/v3 | >=3.0.0-rc1 <3.0.19 | 3.0.19 |
| GO-2025-3995 | Go | github.com/argoproj/argo-cd | all versions | no fix published |
| GO-2025-3995 | Go | github.com/argoproj/argo-cd/v2 | >=2.9.0-rc1 <2.14.20 | 2.14.20 |
| GO-2025-3995 | Go | github.com/argoproj/argo-cd/v3 | >=3.0.0-rc1 <3.0.19 >=3.1.0-rc1 <3.1.8 >=3.2.0-rc1 <3.2.0-rc2 | 3.0.19, 3.1.8, 3.2.0-rc2 |