Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/argoproj/argo-cd/v2Go | >= 2.9.0-rc1, < 2.14.20 | 2.14.20 |
github.com/argoproj/argo-cd/v3Go | >= 3.2.0-rc1, < 3.2.0-rc2 | 3.2.0-rc2 |
github.com/argoproj/argo-cd/v3Go | >= 3.1.0-rc1, < 3.1.8 | 3.1.8 |
github.com/argoproj/argo-cd/v3Go | >= 3.0.0-rc1, < 3.0.19 | 3.0.19 |
Affected products
1Patches
11a023f1ca7feMerge commit from fork
2 files changed · +11 −4
util/webhook/webhook.go+6 −4 modified@@ -154,10 +154,12 @@ func (a *ArgoCDWebhookHandler) affectedRevisionInfo(payloadIf any) (webURLs []st case azuredevops.GitPushEvent: // See: https://learn.microsoft.com/en-us/azure/devops/service-hooks/events?view=azure-devops#git.push webURLs = append(webURLs, payload.Resource.Repository.RemoteURL) - revision = ParseRevision(payload.Resource.RefUpdates[0].Name) - change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID) - change.shaBefore = ParseRevision(payload.Resource.RefUpdates[0].OldObjectID) - touchedHead = payload.Resource.RefUpdates[0].Name == payload.Resource.Repository.DefaultBranch + if len(payload.Resource.RefUpdates) > 0 { + revision = ParseRevision(payload.Resource.RefUpdates[0].Name) + change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID) + change.shaBefore = ParseRevision(payload.Resource.RefUpdates[0].OldObjectID) + touchedHead = payload.Resource.RefUpdates[0].Name == payload.Resource.Repository.DefaultBranch + } // unfortunately, Azure DevOps doesn't provide a list of changed files case github.PushPayload: // See: https://developer.github.com/v3/activity/events/types/#pushevent
util/webhook/webhook_test.go+5 −0 modified@@ -15,6 +15,8 @@ import ( "text/template" "time" + "github.com/go-playground/webhooks/v6/azuredevops" + bb "github.com/ktrysmt/go-bitbucket" "github.com/stretchr/testify/mock" "k8s.io/apimachinery/pkg/labels" @@ -729,6 +731,9 @@ func Test_affectedRevisionInfo_appRevisionHasChanged(t *testing.T) { {true, "refs/tags/no-slashes", bitbucketRefChangedPayload("no-slashes"), "bitbucket ref changed branch or tag name without slashes, targetRevision tag prefixed"}, {true, "refs/tags/no-slashes", gogsPushPayload("no-slashes"), "gogs push branch or tag name without slashes, targetRevision tag prefixed"}, + // Testing fix for https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv + {false, "test", azuredevops.GitPushEvent{Resource: azuredevops.Resource{RefUpdates: []azuredevops.RefUpdate{}}}, "Azure DevOps malformed push event with no ref updates"}, + {true, "some-ref", bitbucketserver.RepositoryReferenceChangedPayload{ Changes: []bitbucketserver.RepositoryChange{ {Reference: bitbucketserver.RepositoryReference{ID: "refs/heads/some-ref"}},
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-gpx4-37g2-c8pvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-59538ghsaADVISORY
- github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b6696804988d5a632bafghsax_refsource_MISCWEB
- github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pvghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2025-3995ghsaWEB
News mentions
0No linked articles in our index yet.