CVE-2025-59538
📋 TL;DR
This vulnerability in Argo CD allows an unauthenticated attacker to crash the argocd-server process by sending a specially crafted Azure DevOps webhook payload. Affected organizations are those running vulnerable Argo CD versions with Azure DevOps webhooks enabled but without authentication credentials configured.
💻 Affected Systems
- Argo CD
📦 What is this software?
Argo Cd by Argoproj
Argo Cd by Argoproj
Argo Cd by Argoproj
Argo Cd by Argoproj
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for Argo CD, disrupting Kubernetes deployments and GitOps workflows until the service is manually restarted.
Likely Case
Intermittent service disruptions when attackers discover and exploit the vulnerability, requiring manual intervention to restart crashed processes.
If Mitigated
No impact if Azure DevOps webhooks are not used or if authentication credentials are properly configured.
🎯 Exploit Status
Exploitation requires sending a single HTTP POST with empty resource.refUpdates array to /api/webhook endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.20, 3.2.0-rc2, 3.1.8, and 3.0.19
Vendor Advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv
Restart Required: Yes
Instructions:
1. Upgrade to patched version. 2. Restart argocd-server. 3. Verify service is running and accepting webhooks.
🔧 Temporary Workarounds
Configure Azure DevOps Webhook Authentication
allSet webhook.azuredevops.username and webhook.azuredevops.password in Argo CD configuration
argocd-cm.yaml: add webhook.azuredevops.username and webhook.azuredevops.password fields
Disable Azure DevOps Webhooks
allRemove or disable Azure DevOps webhook integration if not needed
Remove Azure DevOps webhook configurations from argocd-cm ConfigMap
🧯 If You Can't Patch
- Implement network controls to restrict access to /api/webhook endpoint
- Configure Azure DevOps webhook authentication credentials immediately
🔍 How to Verify
Check if Vulnerable:
Check Argo CD version and verify if Azure DevOps webhooks are enabled without authenticationCheck Version:
argocd version --clientVerify Fix Applied:
After patching, test sending Azure DevOps webhook with empty resource.refUpdates array - service should not crash📡 Detection & Monitoring
Log Indicators:
- panic: runtime error: index out of range
- argocd-server process crashes
- webhook processing errors
Network Indicators:
- HTTP POST requests to /api/webhook with empty resource.refUpdates array
SIEM Query:
source="argocd" AND ("panic" OR "index out of range" OR "webhook crash")