CVE-2025-59538: Argo CD Unauthenticated Remote DoS via Malformed Azure DevOps Git Push Webhook
Summary
CVE-2025-59538: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- argo-cd · Bitnami
- github.com/argoproj/argo-cd/v2 · Go
The same CVE-2025-59538 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It allows users to manage applications and their deployments using Git repositories as the source of truth. The tool is designed to simplify the deployment process and enhance the management of Kubernetes applications. However, it has been found to be vulnerable to a specific issue that can lead to a denial of service (DoS) when processing malformed webhook requests from Azure DevOps.
Vulnerability Detail
The vulnerability arises from the way Argo CD handles incoming git.push webhooks from Azure DevOps. If the webhook payload is malformed, it can trigger an unauthenticated remote denial of service, potentially causing the application to crash or become unresponsive. This can lead to significant downtime and disruption of services, impacting users and organizations relying on Argo CD for their deployment processes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the webhook endpoint to trusted sources only, thereby minimizing the risk of receiving malformed payloads. This can be done by configuring firewall rules or using API gateways to filter incoming requests.
Conclusion
In summary, CVE-2025-59538 poses a significant risk to users of Argo CD by enabling unauthenticated remote denial of service through malformed webhook requests. It is crucial to update to the latest patched versions to ensure the security and reliability of your deployments.
See every vulnerability recorded for github.com/argoproj/argo-cd →
FAQ
CVE-2025-59538 is a vulnerability in Argo CD that allows for unauthenticated remote denial of service via malformed Azure DevOps git.push webhooks.
If your application uses Argo CD and is exposed to this vulnerability, it may become unresponsive or crash when processing malformed webhook requests.
Versions prior to 2.14.20 for v2 and 3.0.19, 3.1.8, or 3.2.0-rc2 for v3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, implement access restrictions to the webhook endpoint as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
