← Vulnerability feed

Vulnerability record · CVE-2025-59537 · published 1 October 2025

CVE-2025-59537: Argoproj argo cd improper input validation vulnerability

Argoproj · Argo Cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

7.5 CVSS 3.1 High EPSS 0.60% · top 53.3% CWE-20 · Improper input validationCWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43 Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2 ExploitMitigationVendor Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2 ExploitMitigationVendor Advisory

Track CVE-2025-59537 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-29165Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with versi…EPSS 2.1%9.9CVE-2025-55190Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.…EPSS 5.5%9.8CVE-2024-21652Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chai…EPSS 0.75%9.6CVE-2026-42880Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a …EPSS 0.56%9.6CVE-2023-40029Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. …EPSS 1.2%9.6CVE-2022-31105Argoproj argo cd improper certificate validation vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 i…EPSS 0.78%9.1CVE-2024-21662Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively by…EPSS 0.84%9.0CVE-2024-31989Argoproj argo cd broken cryptographic algorithm vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2025-59537), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.