Argo CD CVE-2025-59538: Brief Summary of a Remote DoS Vulnerability in Azure DevOps Webhook Handler

Introduction

A single unauthenticated HTTP POST can crash the entire argocd-server process in vulnerable Argo CD deployments, leading to immediate disruption of GitOps workflows. This issue affects organizations using Argo CD with default webhook configurations, regardless of whether Azure DevOps is actively integrated.

Argo CD is a widely used open source GitOps tool for Kubernetes, maintained as a graduated CNCF project. It is a core component in many enterprise Kubernetes environments, automating application delivery and configuration management at scale.

Technical Information

CVE-2025-59538 is a denial of service vulnerability in Argo CD's Azure DevOps webhook handler. The vulnerability is present in the util/webhook/webhook.go file, specifically where the handler processes Azure DevOps git.push webhook events. The root cause is a missing length check before accessing the first element of the resource.refUpdates array in the incoming JSON payload.

When an HTTP POST is sent to /api/webhook with an Azure DevOps event containing an empty refUpdates array, the following occurs:

• The handler attempts to access payload.Resource.RefUpdates[0] without checking if the array is non-empty.
• This triggers a Go runtime panic: index out of range [0] with length 0.
• The panic is not recovered, so the entire argocd-server process crashes.

This is only exploitable if both webhook.azuredevops.username and webhook.azuredevops.password are unset in the Argo CD configuration. In this default state, the webhook handler processes Azure DevOps events without authentication, exposing the vulnerable code path to any network-accessible attacker.

Vulnerable code pattern (from public advisories):

// Vulnerable: no length check before accessing index 0
name := payload.Resource.RefUpdates[0].Name
newOid := payload.Resource.RefUpdates[0].NewObjectID
oldOid := payload.Resource.RefUpdates[0].OldObjectID

The attack requires only a valid-looking Azure DevOps webhook payload with an empty refUpdates array and the appropriate headers (such as X-Vss-ActivityId). No authentication or prior knowledge of the target's Azure DevOps setup is needed.

This vulnerability is classified under CWE-248 (Uncaught Exception) and CWE-703 (Improper Check or Handling of Exceptional Conditions).

Affected Systems and Versions

Products:

• Argo CD

Affected versions:

• 2.9.0-rc1 through 2.14.19
• 3.0.0-rc1 through 3.2.0-rc1
• 3.1.6
• 3.0.17

Vulnerable configuration:

• Occurs when webhook.azuredevops.username and webhook.azuredevops.password are not set (default configuration)

Fixed in:

• 2.14.20
• 3.2.0-rc2
• 3.1.8
• 3.0.19

Vendor Security History

Argo CD has previously addressed webhook-related vulnerabilities and typically issues GitHub advisories and multi-branch patches promptly. The project is recognized for its transparent security practices and rapid response to critical issues. As a CNCF graduated project, Argo CD maintains a strong security posture, but webhook input validation has been a recurring focus area.

References

• NVD entry for CVE-2025-59538
• GitHub Security Advisory: GHSA-gpx4-37g2-c8pv
• Argo CD patch commit
• OSV advisory
• GitLab advisory for v2
• GitLab advisory for v3
• Tenable CVE summary