Most recent entries from all

Withdrawn: CLEANSTART-2026-AC12204 — go-git is a highly extensible git implementation library written in pure Go

2026-10-03T20:06:06.241287+00:00

Withdrawn by the publisher.

Affected: CleanStart: argo-cd-fips

Multiple security vulnerabilities affect the argo-cd-fips package. go-git is a highly extensible git implementation library written in pure Go. See references for individual vulnerability details.

EUVD-2026-254253

2026-10-03T20:06:06.241348+00:00

EUVD-2026-254253

fkie_cve-2025-55191

2026-10-03T20:06:06.241374+00:00

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition. This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

GHSA-g88p-r42r-ppp9 — Repository Credentials Race Condition Crashes Argo CD Server

2026-10-03T20:06:06.241403+00:00

Affected: Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd/v3

### Summary

A race condition in the repository credentials handler can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL.

### Details The vulnerability is located in numerous repository related handlers in the `util/db/repository_secrets.go` file. For example, in the `secretToRepoCred` function. The issue manifests as a concurrent map access panic:

``` concurrent map read and map write ... goroutine 1104 [running]: github.com/argoproj/argo-cd/v2/util/db.(*secretsRepositoryBackend).secretToRepoCred(0xc000e50ea8?, 0xc000c65540) /go/src/github.com/argoproj/argo-cd/util/db/repository_secrets.go:404 +0x31e ```

The race condition occurs due to: 1. Concurrent repository credential operations (create/update/delete) accessing the same map 2. Kubernetes informer re-syncs happening simultaneously 3. Background watchers updating the same secret data 4. No mutex protection for map access

A valid API token with `repositories` resource permissions (`create`, `update`, or `delete` actions) is required to trigger the race condition.

### Impact

This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. Default ArgoCD configuration is vulnerable.

The affected code was originally introduced in [PR #6103](https://github.com/argoproj/argo-cd/pull/6103) an…

openSUSE-SU-2025:15666-1 — govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media

2026-10-03T20:06:06.241446+00:00

govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media

RHSA-2025:17730 — Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.4 security update

2026-10-03T20:06:06.241471+00:00

crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 database/sql: Postgres Scan Race Condition github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service