CVE-2025-59538
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
How to fix
- argoproj argo_cd2.14.20, 3.0.19, 3.1.8 or later
- github.com/argoproj/argo-cd/v22.14.20 or later
- github.com/argoproj/argo-cd/v33.2.0-rc2, 3.1.8, 3.0.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argoproj argo_cd | 2.9.0 ≤ v < 2.14.20, 3.0.0 ≤ v < 3.0.19, 3.1.0 ≤ v < 3.1.8, 3.2.0 | 2.14.20, 3.0.19, 3.1.8 |
| github.com/argoproj/argo-cd/v2Go | 2.9.0-rc1 ≤ v < 2.14.20 | 2.14.20 |
| github.com/argoproj/argo-cd/v3Go | 3.2.0-rc1 ≤ v < 3.2.0-rc2, 3.1.0-rc1 ≤ v < 3.1.8, 3.0.0-rc1 ≤ v < 3.0.19 | 3.2.0-rc2, 3.1.8, 3.0.19 |
| github.com/argoproj/argo-cdGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.