7.5

CVE-2025-59538: argoproj argo_cd Uncaught Exception

CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-gpx4-37g2-c8pvBIT-argo-cd-2025-59538GO-2025-3995
Published 01-10-2025Last modified 02-10-2025
Open JSON

Vulnerability summary

CVE-2025-59538 is a high (CVSS 7.5) Uncaught Exception vulnerability in argoproj argo_cd. EPSS estimates a 8.93% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
8.93%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 3 · Related 4
OPENSUSE-SU-2025:15666-1OPENSUSE-SU-2026:21483-1SUSE-SU-2025:3799-1CGA-CFR5-7RH8-V7M7

Timeline

  1. 01-10-2025
    PublishedVulnerability first disclosed.
  2. 02-10-2025
    Last modifiedVulnerability information updated.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

8.93%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.93% on 19-09-2026

19-09-202619-10-2026
EPSS score
8.93%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Argo Cd

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Argoproj2 products
  • argo_cdEOL≥ 2.9.0, < 2.14.20 | ≥ 3.0.0, < 3.0.19 | ≥ 3.1.0, < 3.1.8 | 3.2.0:rc1
  • argo-cd≥ 2.9.0-rc1, < 2.14.20 | ≥ 3.2.0-rc1, < 3.2.0-rc2 | ≥ 3.1.0-rc1, < 3.1.8 | ≥ 3.0.0-rc1, < 3.0.19
Chainguard2 products
  • argo-cd-2.13All versions (No fix recorded) | < 2.13.9-r5
  • argo-cd-2.13-compatAll versions (No fix recorded)
Github.com/argoproj/argo-cd2 products
  • v2≥ 2.9.0-rc1, < 2.14.20
  • v3≥ 3.1.0-rc1, < 3.1.8 | ≥ 3.0.0-rc1, < 3.0.19 | ≥ 3.2.0-rc1, < 3.2.0-rc2
Github.com/argoproj1 product
  • argo-cdAll versions (No fix recorded)

4 vendors · 7 products

References

6 links