Database/Container, Kubernetes & orchestration

Argo CD: race in SessionManager lets attackers bypass login rate limiting and brute force accounts

UnscoredCVE-2025-61560Container, Kubernetes & orchestrationcurated

Impact

Argo CD's SessionManager counts failed logins in a way that can be raced, so an attacker sending crafted requests concurrently is not throttled and can brute force the local admin or other local accounts. On a GPU fleet Argo CD is usually the component that can write any manifest into any namespace, so a guessed password is equivalent to cluster-wide workload control: an attacker can schedule pods onto GPU nodes, mount host paths, or swap the image of an inference deployment. Reported against Argo CD v3.0.6. The record does not state a fixed version.

Who can reach it

Anyone who can reach the Argo CD API or web UI - no authentication needed to attempt the bypass, only the ability to send repeated requests to the login endpoint. Exposure depends on whether the Argo CD server is published beyond the cluster or kept behind an ingress with its own authentication.

What to do

Follow the GitHub security advisory (GHSA-4439-h7jw-5cjj) for the fixed release and upgrade the argocd-server deployment; this is a rolling restart of the Argo CD control plane and does not touch GPU nodes or running workloads. Until then, prefer SSO over local accounts, disable or rotate the local admin account, and put the login endpoint behind an authenticating proxy or a network policy that limits who can reach it.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-61560 https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.