---
id: CVE-2025-59538
title: 'Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes'
summary: >-
  Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For
  versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and
  3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password
  are n…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
  - CWE-703
vendor: argoproj
product: argo_cd
affected:
  - 'argo_cd >= 2.9.0, < 2.14.20'
  - 'argo_cd >= 3.0.0, < 3.0.19'
  - 'argo_cd >= 3.1.0, < 3.1.8'
  - argo_cd = 3.2.0
patched:
  - argo_cd 3.1.8
published: '2025-10-01'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59538'
references:
  - url: >-
      https://github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b6696804988d5a632baf
    label: security-advisories@github.com
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv
    label: security-advisories@github.com
  - url: >-
      https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.08927
epssPercentile: 0.95136
ingestedAt: '2026-10-12T15:55:08.066Z'
---

## Overview

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

## Affected

- `argo_cd >= 2.9.0, < 2.14.20`
- `argo_cd >= 3.0.0, < 3.0.19`
- `argo_cd >= 3.1.0, < 3.1.8`
- `argo_cd = 3.2.0`

## Remediation

Upgrade past the affected range:

- `argo_cd 3.1.8`