All vulnerabilities
CVE-2025-61560GHSA-4439-h7jw-5cjj

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated cr

n/a n/aApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.15Also 3.4.10, 3.5.4 and 1 moreGitHub
Published9 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3.3.15github.com/argoproj/argo-cd/v3, goGitHubgo get github.com/argoproj/argo-cd/v3@v3.3.15
  • 3.4.10github.com/argoproj/argo-cd/v3, goGitHubgo get github.com/argoproj/argo-cd/v3@v3.4.10
  • 3.5.4github.com/argoproj/argo-cd/v3, goGitHubgo get github.com/argoproj/argo-cd/v3@v3.5.4
  • 3.6.0-rc2github.com/argoproj/argo-cd/v3, goGitHubgo get github.com/argoproj/argo-cd/v3@v3.6.0-rc2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

Text from CVE List

Affected versions 4

  • n/aaffected: n/aCVE List
  • github.com/argoproj/argo-cd, go>= 1.5.3, < 2.0.0GitHub
  • github.com/argoproj/argo-cd/v2, go>= 2.0.0GitHub
  • github.com/argoproj/argo-cd/v3, go>= 3.0.0, < 3.3.15 || >= 3.4.0, < 3.4.10 || >= 3.5.0, < 3.5.4 || = 3.6.0-rc1GitHub

References 2