CVE-2025-61560: Argo CD Race Condition Vulnerability

CVE-2025-61560 Overview

CVE-2025-61560 is a race condition vulnerability in the SessionManager component of Argo CD v3.0.6, a GitOps continuous delivery tool maintained by the Cloud Native Computing Foundation (CNCF). The flaw allows attackers to bypass authentication rate limiting by issuing repeated crafted requests concurrently. Once rate limiting is bypassed, attackers can perform brute force attacks against user credentials. Argo CD operates with privileged access to Kubernetes clusters, making credential compromise a direct path to cluster takeover.

Critical Impact
Attackers can bypass authentication rate limiting in Argo CD SessionManager and brute force user credentials, potentially gaining administrative access to Kubernetes clusters managed by Argo CD.

Affected Products

CNCF Argo CD v3.0.6
Argo CD deployments exposing the API or UI login endpoint
Kubernetes environments relying on Argo CD for GitOps-based continuous delivery

Discovery Timeline

2026-10-09 - CVE-2025-61560 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2025-61560

Vulnerability Analysis

The vulnerability resides in Argo CD's SessionManager, which enforces authentication rate limits to defend against brute force attacks. The rate limit check and the counter update are not performed atomically. Multiple concurrent login requests can pass the rate limit check before any of them increment the failure counter.

This is a classic Time-of-Check to Time-of-Use (TOCTOU) flaw [CWE-367]. Rate limiting degrades from a hard ceiling into a loose guideline when requests arrive in parallel. Attackers can submit large batches of password guesses per second against a target account without triggering lockout.

Because Argo CD typically holds cluster-admin privileges within its managed Kubernetes namespaces, successful credential compromise can lead to arbitrary workload deployment, secret exfiltration, and lateral movement across the cluster.

Root Cause

The root cause is a non-atomic sequence between checking the authentication attempt counter and updating it. The SessionManager reads the current attempt count, evaluates it against the configured threshold, and then updates the counter. Concurrent requests observe stale state and proceed past the rate limit gate simultaneously.

Attack Vector

An unauthenticated attacker sends concurrent HTTP POST requests to the Argo CD login endpoint, each containing a candidate password for a known or guessed username. The race window permits far more attempts than the configured rate limit allows. Reference the GitHub Security Advisory GHSA-4439-h7jw-5cjj for maintainer-provided technical detail. No sanitized proof-of-concept code is published; the vulnerability pattern involves parallel HTTP requests rather than a crafted payload.

Detection Methods for CVE-2025-61560

Indicators of Compromise

High-frequency POST requests to the Argo CD /api/v1/session login endpoint from a single source IP or small set of IPs
Repeated authentication failures for the same username within short time windows that exceed the configured rate limit
Successful Argo CD logins immediately preceded by hundreds or thousands of failed attempts
Argo CD API tokens or sessions used from unexpected geolocations or user agents following a burst of failed logins

Detection Strategies

Ingest Argo CD API server logs and alert on authentication failure rates exceeding the documented rate limit per user or source IP
Correlate Argo CD login events with downstream Kubernetes RBAC actions executed under the argocd-server service account
Deploy upstream rate limiting at the ingress or Web Application Firewall (WAF) layer and alert when thresholds are exceeded

Monitoring Recommendations

Forward Argo CD audit logs to a centralized SIEM for real-time analysis of login patterns
Monitor Kubernetes audit logs for unusual Application or AppProject modifications originating from Argo CD
Track outbound network connections from Argo CD pods for signs of secret exfiltration following suspicious logins

How to Mitigate CVE-2025-61560

Immediate Actions Required

Upgrade Argo CD to a version containing the fix as noted in the GitHub Security Advisory GHSA-4439-h7jw-5cjj
Restrict network exposure of the Argo CD API and UI to trusted networks or VPN-only access
Enforce Single Sign-On (SSO) with a strong identity provider and disable the local admin account where feasible
Rotate Argo CD local account passwords and API tokens if brute force activity is suspected

Patch Information

Refer to the maintainer advisory at GHSA-4439-h7jw-5cjj and the Argo CD GitHub repository for the fixed release and patch commits. Deploy the patched container image to all Argo CD instances and verify the SessionManager version in the running pods.

Workarounds

Place Argo CD behind an authenticating reverse proxy or ingress controller that enforces strict per-source rate limiting on the login endpoint
Disable local user accounts and enforce SSO authentication through an external identity provider, removing the brute-forceable surface
Apply network policies restricting access to the argocd-server service to administrative subnets only
Enable multi-factor authentication at the identity provider layer so brute-forced passwords alone are insufficient

bash

# Example NetworkPolicy restricting Argo CD server access to an admin namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-server-restrict
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-server
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: admin