CVE-2025-59538: Argo CD Vulnerable to Unauthenticated Remote DoS via Malformed Azure DevOps Git.Push Webhook
Summary
CVE-2025-59538: Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook. Affects argo-cd across 3 version ranges.
>= 2.9.0, < 2.14.20
>= 3.0.0, < 3.0.19
>= 3.1.0, < 3.1.8
Fixed in 2.14.20, 3.0.19 or 3.1.8, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-59538 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo CD is a declarative, GitOps continuous delivery tool designed for Kubernetes environments. It enables developers to manage application deployments through Git repositories, ensuring that the deployed state matches the desired state defined in Git. Argo CD supports various features such as automated syncing, health monitoring, and rollback capabilities, making it a popular choice for continuous delivery workflows. However, certain versions of Argo CD are susceptible to a critical vulnerability that can lead to denial of service (DoS) when specific webhook configurations are not set.
Vulnerability Detail
The vulnerability arises in Argo CD versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6, and 3.0.17. When the 'webhook.azuredevops.username' and 'webhook.azuredevops.password' are not configured, the '/api/webhook' endpoint can crash the entire argocd-server process upon receiving an Azure DevOps Push event with an empty 'resource.refUpdates' JSON array. This results in an index-out-of-range panic due to an unguarded access to the slice index [0]. A single unauthenticated HTTP POST request can exploit this vulnerability, leading to a complete service disruption.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.9.0, < 2.14.202.14.20 -
>= 3.0.0, < 3.0.193.0.19 -
>= 3.1.0, < 3.1.83.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the 'webhook.azuredevops.username' and 'webhook.azuredevops.password' are set in the Argo CD configuration to prevent the crash when receiving Azure DevOps Push events. This can be done by modifying the Argo CD ConfigMap:
kubectl edit configmap argocd-cm -n argocd
Add the following lines: webhook.azuredevops.username: <your_username> webhook.azuredevops.password: <your_password>
Conclusion
In summary, CVE-2025-59538 represents a significant vulnerability in Argo CD that can lead to a denial of service through unauthenticated access to the webhook API. It is crucial for users of affected versions to update to the patched releases or implement the recommended workarounds to secure their deployments.
See every vulnerability recorded for argo-cd →
FAQ
Versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6, and 3.0.17 are affected.
An unauthenticated user can send a specially crafted HTTP POST request to the '/api/webhook' endpoint, causing the argocd-server process to crash, leading to a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, ensure that the 'webhook.azuredevops.username' and 'webhook.azuredevops.password' are configured in your Argo CD settings to mitigate the risk.
More details can be found in the vulnerability report on GitHub at https://github.com/bitnami/vulndb/tree/main/data/argo-cd/BIT-argo-cd-2025-59538.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for argo-cd.
