---
id: CVE-2025-55191
title: >-
  github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race
  condition leading to crash (CVE-2025-55191)
summary: >-
  A race condition has been discovered in the Argo CD GitOps tool. This race
  condition is located in the repository credentials handler that can cause the
  Argo CD server to panic and crash when concurrent operations are performed on
  the same…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-362
vendor: Red Hat
product: Red Hat OpenShift GitOps 1.16
affected:
  - developer_hub
  - openshift_gitops
  - openshift_gitops 1.16
  - openshift_gitops 1.17
  - openshift_gitops 1.18
patched:
  - openshift_gitops 1.16
  - openshift_gitops 1.17
  - openshift_gitops 1.18
published: '2025-09-30'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T17:10:46+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55191.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55191.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-55191'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2400562'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-55191'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-55191'
  - url: >-
      https://github.com/argoproj/argo-cd/commit/701bc50d01c752cad96185f848088d287a97c7b7
  - url: 'https://github.com/argoproj/argo-cd/pull/6103'
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-g88p-r42r-ppp9
  - url: 'https://access.redhat.com/errata/RHSA-2025:17730'
  - url: 'https://access.redhat.com/errata/RHSA-2025:17731'
  - url: 'https://access.redhat.com/errata/RHSA-2025:18093'
  - url: 'https://github.com/argoproj/argo-cd'
  - url: 'https://pkg.go.dev/vuln/GO-2025-3994'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
  - score-dispute
epss: 0.00472
epssPercentile: 0.40028
aliases:
  - GHSA-g88p-r42r-ppp9
  - BIT-argo-cd-2025-55191
  - GO-2025-3994
ecosystem: go
scores:
  vendor: 4.3
  osv: 6.5
ingestedAt: '2026-08-24T19:25:44.633Z'
---

## Overview

A race condition has been discovered in the Argo CD GitOps tool. This race condition is located in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition.

## Vendor advisories

- **RHSA-2025:17730** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.16 · released 2025-10-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:17730)
- **RHSA-2025:17731** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.17 · released 2025-10-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:17731)
- **RHSA-2025:18093** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.18 · released 2025-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2025:18093)
- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Red Hat OpenShift GitOps · no fix planned: Red Hat Developer Hub, Red Hat OpenShift GitOps · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55191.json)

**github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash** — rated Moderate by Red Hat. Released 2025-09-30, updated 2026-09-21.

Affected:

- Red Hat Developer Hub
- Red Hat OpenShift GitOps

Fixed:

- Red Hat OpenShift GitOps 1.16
- Red Hat OpenShift GitOps 1.17
- Red Hat OpenShift GitOps 1.18

No fix planned:

- Red Hat Developer Hub
- Red Hat OpenShift GitOps

Not affected:

- Red Hat OpenShift GitOps 1.16
- Red Hat OpenShift GitOps 1.17
- Red Hat OpenShift GitOps 1.18

## Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:17730
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:17731
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:18093

Workarounds / mitigations:

- Systems may be configured to automatically restart a service upon crash and doing so may partially mitigate the availability impact of this vulnerability.

## Package advisory (CVE-2025-55191)

Affected packages:

- `github.com/argoproj/argo-cd/v2 >= 2.1.0, < 2.14.20`
- `github.com/argoproj/argo-cd/v3 >= 3.2.0-rc1, < 3.2.0-rc2`
- `github.com/argoproj/argo-cd/v3 >= 3.1.0-rc1, < 3.1.8`
- `github.com/argoproj/argo-cd/v3 >= 3.0.0-rc1, < 3.0.19`

Patched in:

- `github.com/argoproj/argo-cd/v2 2.14.20`
- `github.com/argoproj/argo-cd/v3 3.2.0-rc2`
- `github.com/argoproj/argo-cd/v3 3.1.8`
- `github.com/argoproj/argo-cd/v3 3.0.19`

Source: https://osv.dev/vulnerability/GHSA-g88p-r42r-ppp9