GPU VulnDB

Database/Container, Kubernetes & orchestration

Argo CD: unauthenticated Gogs push event with a null commit repo crashes the API server

CVSS 7.5CVE-2025-59537Container, Kubernetes & orchestrationcurated

Impact

With the default configuration (no webhook.gogs.secret set), a Gogs push event whose commits[].repo field is null or missing crashes the entire argocd-server process. This is a separate code path and a separate fix from the Bitbucket Server crash in CVE-2025-59531, but the operator consequence is the same: unauthenticated denial of service on the GitOps control plane, and with all replicas targeted, a full Argo CD API outage. On a GPU cluster that ships driver, GPU Operator and inference manifests through Argo CD, syncs and rollbacks stop until the process is restarted or patched.

Who can reach it

Anyone with network reach to argocd-server's HTTP endpoint. Unauthenticated; no webhook secret required in the default configuration.

What to do

Upgrade to Argo CD 2.14.20, 3.0.19, 3.1.8 or 3.2.0-rc2 and restart argocd-server - control-plane restart only, GPU nodes untouched. Interim mitigation: configure webhook.gogs.secret and restrict network access to /api/webhook.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59537https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43

Related entries

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.