CVE-2025-59531

Published Oct 1, 2025

Last updated 5 months ago

CVSS high 7.5

Overview

Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Source: security-advisories@github.com
NVD status: Analyzed
Products: argo_cd

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-703

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CDA16487-4630-4646-9952-32E096B64251",
            "versionEndIncluding": "1.8.7",
            "versionStartIncluding": "1.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FD4B38D5-4CEC-4C24-AD81-92B9DA4426AC",
            "versionEndExcluding": "2.14.20",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E7FEAEBF-40B8-40E4-B34B-2785B0FEAFEB",
            "versionEndExcluding": "3.0.19",
            "versionStartIncluding": "3.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AFF4E847-D3D6-457A-A47B-98799D28E20E",
            "versionEndExcluding": "3.1.8",
            "versionStartIncluding": "3.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:argoproj:argo_cd:3.2.0:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "247C0721-E494-4732-BF53-F249C574A702",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References