Introduction
A single malformed webhook request can crash Argo CD's API server. When the server goes down, all deployment automation stops with it, which affects production Kubernetes environments. The vulnerability, tracked as CVE-2025-59537, comes down to insufficient input validation in a widely used DevOps tool, and it lets an attacker cause denial of service with minimal effort.
About Argo CD: Argo CD is a leading open-source GitOps continuous delivery tool for Kubernetes, maintained by the Argo Project under the CNCF. It is widely adopted in enterprise DevOps pipelines and runs deployment automation for organizations of all sizes. Its webhook integration lets it sync with Git repositories in real time, which makes it a critical component in modern CI/CD workflows.
Technical Information
CVE-2025-59537 is a NULL pointer dereference vulnerability in Argo CD's webhook handler for Gogs push events. The vulnerable code is in the affectedRevisionInfo function, which processes incoming webhook payloads. When the /api/webhook endpoint receives a Gogs webhook payload where the commits[].repo field is null or missing, the handler tries to access payload.Repo.HTMLURL without checking whether payload.Repo is nil. That access causes a runtime panic and crashes the argocd-server process, which denies service to all clients.
Triggering the bug takes an HTTP POST request to the /api/webhook endpoint with the X-Gogs-Event: push header and a crafted JSON body. The request needs no authentication and no elevated privileges. The root cause is that the handler never validates whether the Repo field in the PushPayload struct is present.
Here is the vulnerable code path, as it appears in the public patch:
case gogsclient.PushPayload: if payload.Repo != nil { webURLs = append(webURLs, payload.Repo.HTMLURL) } // ...
Before the patch, the code read payload.Repo.HTMLURL without checking for nil first.
Patch Information
The Argo CD team's patch adds a nil check on the Repo field of the PushPayload struct before the code reads any of its properties. With the check in place, the application no longer dereferences a nil pointer and crashes.
The patch is included in the following Argo CD versions:
- v2.14.20
- v3.2.0-rc2
- v3.1.8
- v3.0.19
Users should upgrade to one of these versions to fix the vulnerability.
For more details, see the official advisory: GHSA-wp4p-9pxh-cgx2
Affected Systems and Versions
The following Argo CD versions are affected:
- 1.2.0 through 1.8.7
- 2.0.0-rc1 through 2.14.19
- 3.0.0-rc1 through 3.2.0-rc1
- 3.1.7
- 3.0.18
A system is vulnerable if it runs any of these versions and exposes the /api/webhook endpoint without a webhook.gogs.secret configured. Default installations are affected unless the secret is set.
Vendor Security History
Argo CD has fixed vulnerabilities related to input validation and access control before. The project has mature security practices and usually responds quickly to disclosures. Its community engagement and responsible disclosure processes are well established.
