CVE-2025-55191: Repository Credentials Race Condition Crashes Argo CD Server
Summary
CVE-2025-55191: Repository Credentials Race Condition Crashes Argo CD Server. Affects github.com/argoproj/argo-cd/v2 versions >= 2.1.0, < 2.14.20. Fixed in 2.14.20. How to fix ↓
Also tracked for
- github.com/argoproj/argo-cd · Go
- argo-cd · Bitnami
The same CVE-2025-55191 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It enables users to manage Kubernetes resources through Git repositories, providing features like automated deployments, version control, and rollback capabilities. However, a race condition vulnerability has been identified in its repository credentials handler, which can lead to server crashes under concurrent operations.
Vulnerability Detail
The vulnerability arises from a race condition in the repository credentials handler located in the util/db/repository_secrets.go file. When multiple concurrent operations (create, update, delete) are performed on the same repository URL, it can cause a panic due to concurrent map access, resulting in the Argo CD server crashing. This issue can be exploited by an attacker with valid API token permissions for repositories, leading to a denial-of-service state and disrupting GitOps operations.
How To Fix
Latest published version: v2.14.21 as of 22 Oct 2026
go get github.com/argoproj/argo-cd/v2@v2.14.21Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.20
This is the first release that contains the fix.
go get github.com/argoproj/argo-cd/v2@v2.14.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid performing concurrent operations on the same repository URL until the package is updated to a patched version. This can help mitigate the risk of triggering the race condition.
Conclusion
CVE-2025-55191 is a significant vulnerability in Argo CD that can lead to server crashes due to a race condition in the repository credentials handler. It is crucial to update to the patched versions to ensure the stability and security of your deployments.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
CVE-2025-55191 is a vulnerability in Argo CD that allows a race condition in the repository credentials handler, potentially causing the server to crash.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Exploitation of this vulnerability can lead to a denial-of-service state, making the Argo CD server unavailable and disrupting all GitOps operations.
If immediate updates are not possible, refrain from performing concurrent operations on the same repository URL to minimize the risk of triggering the race condition.
The vulnerability was discovered and reported by @thevilledev, who also contributed to its resolution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
