Vulnpedia
← Search CVEs

CVE-2025-61560

HIGH 8.1

Published 2026-10-09 · Last modified 2026-10-19

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

ELEVATED IMPACT

Severe if exploited (CVSS 8.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 25th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.1CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

CPE data not yet published (analysis pending).

Weakness (CWE)

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

  • odf4/odf-multicluster-rhel9-operator as a component of Red Hat Openshift Data Foundation 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/odf-multicluster-rhel9-operator?repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00
  • openshift-gitops-1/argocd-agent-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-agent-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00
  • openshift-gitops-1/argocd-image-updater-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-image-updater-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00
  • openshift-gitops-1/argocd-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00
  • openshift-gitops-1/gitops-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00
  • openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9-operator?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator

    • workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
    • none available: Affected
    Red Hat · CVE-2025-61560 · Updated 2026-10-20T19:04:36+00:00

All CVSS metrics

  • HIGH 8.1 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • HIGH 8.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS