{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61560", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-19T18:51:37.458Z", "dateReserved": "2025-09-26T00:00:00.000Z", "datePublished": "2026-10-09T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-09T16:05:43.861Z"}, "descriptions": [{"lang": "en", "value": "A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/argoproj/argo-cd/"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T17:44:10.687702Z", "id": "CVE-2025-61560", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:51:37.458Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61560", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-19T18:51:37.458Z", "dateReserved": "2025-09-26T00:00:00.000Z", "datePublished": "2026-10-09T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-09T16:05:43.861Z"}, "descriptions": [{"lang": "en", "value": "A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/argoproj/argo-cd/"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-19T17:44:10.687702Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T17:44:32.614Z"}}]}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests."}], "id": "CVE-2025-61560", "lastModified": "2026-10-19T19:17:03.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61560", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-19T17:44:10.687702Z", "version": "2.0.3"}}]}, "published": "2026-10-09T17:16:41.183", "references": [{"source": "cve@mitre.org", "url": "https://github.com/argoproj/argo-cd/"}, {"source": "cve@mitre.org", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/argoproj/argo-cd: argo-cd: Rate limit bypass via race condition in SessionManager", "id": "2548720", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548720"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-307", "details": ["A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.", "A flaw was found in Argo CD. A race condition in the SessionManager component allows a remote attacker to bypass rate limiting protections by sending concurrent requests. Consequently, an attacker can conduct automated brute-force attacks against user accounts without being blocked."], "mitigation": {"lang": "en:us", "value": "To reduce exposure to brute-force attempts against authentication endpoints:\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."}, "name": "CVE-2025-61560", "package_state": [{"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "package_name": "odf4/odf-multicluster-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-agent-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-image-updater-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel9-operator", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2026-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-61560\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-61560\nhttps://github.com/argoproj/argo-cd/\nhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"], "statement": "This vulnerability is rated as Moderate because exploiting the flaw requires winning a timing race condition with concurrent requests and only aids in credential guessing against local accounts, rather than permitting arbitrary code execution or direct privilege elevation. In Red Hat OpenShift GitOps deployments configured with OpenShift OAuth or enterprise Single Sign-On (SSO), native authentication rate limiting is avoided because requests are authenticated by the external provider. Environments utilizing built-in local credentials carry higher exposure, though an attacker still needs to successfully identify valid credentials.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.6"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "argo-cd", "vendor": "argoproj"}], "created": "2026-10-09T17:45:11.280936+00:00", "updated": "2026-10-20T07:15:11.310956+00:00", "vendors": ["argoproj", "argoproj$PRODUCT$argo-cd"]}