CVE-2025-55191: argoproj argo_cd Race Condition

Vulnerability summary

CVE-2025-55191 is a medium (CVSS 6.5) Race Condition vulnerability in argoproj argo_cd. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.4% of scored vulnerabilities.

Timeline

1. 30-09-2025
   PublishedVulnerability first disclosed.
2. 06-10-2025
   Last modifiedVulnerability information updated.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition. This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.