CVE-2025-55191Medium· 4.3▾ SunlitA race condition has been discovered in the Argo CD GitOps tool. This race condition is located in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
6.5 → 4.3
0.4% → 0.5%
A race condition has been discovered in the Argo CD GitOps tool. This race condition is located in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition.
github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash — rated Moderate by Red Hat. Released 2025-09-30, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:17730 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:17731 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:18093
Workarounds / mitigations:
Affected packages:
github.com/argoproj/argo-cd/v2 >= 2.1.0, < 2.14.20github.com/argoproj/argo-cd/v3 >= 3.2.0-rc1, < 3.2.0-rc2github.com/argoproj/argo-cd/v3 >= 3.1.0-rc1, < 3.1.8github.com/argoproj/argo-cd/v3 >= 3.0.0-rc1, < 3.0.19Patched in:
github.com/argoproj/argo-cd/v2 2.14.20github.com/argoproj/argo-cd/v3 3.2.0-rc2github.com/argoproj/argo-cd/v3 3.1.8github.com/argoproj/argo-cd/v3 3.0.19Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-35255Medium· 5.5azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity (CVE-2024…
CVE-2025-10263Critical· 9.1Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may all…
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-98870Medium· 6.5kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
CVE-2026-55889Medium· 5.3xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)