PT-2025-40055 · Argo Cd · Argo Cd

Jake-Ciolek · Published 2025-09-30 · Updated 2025-10-27 · CVE-2025-59531

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Argo CD versions 1.2.0 through 1.8.7 Argo CD versions 2.0.0-rc1 through 2.14.19 Argo CD versions 3.0.0-rc1 through 3.2.0-rc1 Argo CD version 3.1.7 Argo CD version 3.0.18

Description Argo CD is susceptible to denial of service through malicious API requests. Specifically, when a webhook.bitbucketserver.secret is not configured, the /api/webhook endpoint crashes upon receiving a malformed Bitbucket Server payload where the repository.links.clone field is not an array. A single unauthenticated request can cause the API server to enter a CrashLoopBackOff state, and targeting all replicas can result in a complete API outage. The issue stems from an unsafe type assertion within the webhook.go file, which panics when the expected array type is not met. A proof-of-concept (PoC) demonstrates that sending a crafted JSON payload to the /api/webhook endpoint can trigger this panic and crash the server.

Recommendations For Argo CD versions 1.2.0 through 1.8.7, configure a webhook.bitbucketserver.secret to ensure only trusted parties can invoke the webhook handler. For Argo CD versions 2.0.0-rc1 through 2.14.19, configure a webhook.bitbucketserver.secret to ensure only trusted parties can invoke the webhook handler. For Argo CD versions 3.0.0-rc1 through 3.2.0-rc1, configure a webhook.bitbucketserver.secret to ensure only trusted parties can invoke the webhook handler. For Argo CD version 3.1.7, configure a webhook.bitbucketserver.secret to ensure only trusted parties can invoke the webhook handler. For Argo CD version 3.0.18, configure a webhook.bitbucketserver.secret to ensure only trusted parties can invoke the webhook handler. If Bitbucket Server is not used, set the webhook.bitbucketserver.secret to a long, random value to effectively disable webhook handling for Bitbucket Server payloads.

Exploit

Fix

DoS

Weakness Enumeration

CWE-703

Related Identifiers

BIT-ARGO-CD-2025-59531

CVE-2025-59531

GHSA-F9GQ-PRRC-HRHC

GO-2025-3993

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Argo Cd

References · 54

• 🔥 https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59531.json · Exploit
• https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f · Patch
• https://osv.dev/vulnerability/CVE-2025-59531 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f9gq-prrc-hrhc · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2025-59531 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59531 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://suse.com/security/cve/CVE-2024-58260 · Note
• https://suse.com/security/cve/CVE-2025-59354 · Note
• https://suse.com/security/cve/CVE-2025-23267 · Note
• https://pkg.go.dev/vuln/GO-2025-3993 · Note