CVE-2025-59538: 
Argo CD vulnerability analysis and mitigation

Argo CD, a declarative GitOps continuous delivery tool for Kubernetes, was found to contain a vulnerability (CVE-2025-59538) affecting versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6, and 3.0.17. The vulnerability was discovered by Jakub Ciolek at AlphaSense and involves an unauthenticated remote denial of service (DoS) attack vector through the /api/webhook endpoint when processing Azure DevOps Push events (GitHub Advisory).

The vulnerability occurs when webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration. The issue stems from accessing the slice index [0] without performing a length check on the resource.refUpdates JSON array, causing an index-out-of-range panic when the array is empty. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness is categorized under CWE-248 (Uncaught Exception) and CWE-703 (Improper Check or Handling of Exceptional Conditions) (GitHub Advisory).

When exploited, this vulnerability allows an attacker to crash the entire argocd-server process with a single unauthenticated HTTP POST request. This results in a denial of service condition, affecting the availability of the Argo CD service. The impact is particularly severe as it requires no authentication or special privileges to execute (GitHub Advisory).

The vulnerability is easily exploitable through a malformed Azure DevOps git.push webhook request. An attacker can trigger the vulnerability by sending a specially crafted HTTP POST request to the /api/webhook endpoint containing an empty refUpdates array in the JSON payload. No authentication or special privileges are required to exploit this vulnerability (GitHub Advisory).

The issue has been resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8, and 3.0.19. For users unable to upgrade immediately, two workaround options are available: 1) Configure a webhook secret to ensure only trusted parties can invoke the webhook handler if Azure DevOps integration is needed, or 2) Set the webhook secrets to long, random values to effectively disable webhook handling for Azure DevOps payloads if Azure DevOps integration is not required (GitHub Advisory).