Introduction
A single unauthenticated HTTP POST can crash the entire argocd-server process in vulnerable Argo CD deployments and immediately disrupt GitOps workflows. The issue affects organizations that run Argo CD with default webhook configurations, whether or not they actively integrate Azure DevOps.
Argo CD is a widely used open source GitOps tool for Kubernetes, maintained as a graduated CNCF project. It is a core component in many enterprise Kubernetes environments, where it automates application delivery and configuration management at scale.
Technical Information
CVE-2025-59538 is a denial of service vulnerability in Argo CD's Azure DevOps webhook handler. The vulnerable code is in the util/webhook/webhook.go file, where the handler processes Azure DevOps git.push webhook events. The root cause is a missing length check before the handler reads the first element of the resource.refUpdates array in the incoming JSON payload.
When someone sends an HTTP POST to /api/webhook with an Azure DevOps event that contains an empty refUpdates array, this happens:
- The handler reads
payload.Resource.RefUpdates[0]without checking whether the array is non-empty. - Go raises a runtime panic:
index out of range [0] with length 0. - Nothing recovers the panic, so the entire
argocd-serverprocess crashes.
The vulnerability is exploitable only when both webhook.azuredevops.username and webhook.azuredevops.password are unset in the Argo CD configuration. That is the default. In this state the webhook handler accepts Azure DevOps events without authentication, which exposes the vulnerable code path to any network-accessible attacker.
Vulnerable code pattern (from public advisories):
// Vulnerable: no length check before accessing index 0 name := payload.Resource.RefUpdates[0].Name newOid := payload.Resource.RefUpdates[0].NewObjectID oldOid := payload.Resource.RefUpdates[0].OldObjectID
The attacker needs only a valid-looking Azure DevOps webhook payload with an empty refUpdates array and the appropriate headers (such as X-Vss-ActivityId). The attack requires no authentication and no prior knowledge of the target's Azure DevOps setup.
The vulnerability is classified under CWE-248 (Uncaught Exception) and CWE-703 (Improper Check or Handling of Exceptional Conditions).
Affected Systems and Versions
Product: Argo CD
Affected versions:
- 2.9.0-rc1 through 2.14.19
- 3.0.0-rc1 through 3.2.0-rc1
- 3.1.6
- 3.0.17
Vulnerable configuration: webhook.azuredevops.username and webhook.azuredevops.password are not set (the default configuration).
Fixed in:
- 2.14.20
- 3.2.0-rc2
- 3.1.8
- 3.0.19
Vendor Security History
Argo CD has fixed webhook-related vulnerabilities before, and it typically publishes GitHub advisories and multi-branch patches promptly. The project is known for transparent security practices and fast responses to critical issues. As a CNCF graduated project, its overall security posture is strong, but webhook input validation has come up repeatedly.
