---
id: CVE-2025-59531
title: 'Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes'
summary: >-
  Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
  Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through
  3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can
  crash the…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-703
vendor: argoproj
product: argo_cd
affected:
  - 'argo_cd >= 1.2.0, <= 1.8.7'
  - 'argo_cd >= 2.0.0, < 2.14.20'
  - 'argo_cd >= 3.0.0, < 3.0.19'
  - 'argo_cd >= 3.1.0, < 3.1.8'
  - argo_cd = 3.2.0
patched:
  - argo_cd 3.1.8
published: '2025-10-01'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59531'
references:
  - url: >-
      https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f
    label: security-advisories@github.com
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc
    label: security-advisories@github.com
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00588
epssPercentile: 0.46582
ingestedAt: '2026-10-12T15:55:08.066Z'
---

## Overview

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

## Affected

- `argo_cd >= 1.2.0, <= 1.8.7`
- `argo_cd >= 2.0.0, < 2.14.20`
- `argo_cd >= 3.0.0, < 3.0.19`
- `argo_cd >= 3.1.0, < 3.1.8`
- `argo_cd = 3.2.0`

## Remediation

Upgrade past the affected range:

- `argo_cd 3.1.8`