{"schema":"vulnpedia.research/1","cve":"CVE-2025-61560","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/argoproj/argo-cd/","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-09T16:05:43.861Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-09T16:05:43.861Z","url":"https://github.com/argoproj/argo-cd/"},{"source":"nvd","sourceId":"CVE-2025-61560","modified":"2026-10-19T19:17:03.790","url":"https://github.com/argoproj/argo-cd/"},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://github.com/argoproj/argo-cd/"}]},{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-09T16:05:43.861Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-09T16:05:43.861Z","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"},{"source":"nvd","sourceId":"CVE-2025-61560","modified":"2026-10-19T19:17:03.790","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61560","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://access.redhat.com/security/cve/CVE-2025-61560"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548720","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548720"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61560","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2025-61560"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61560","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61560"}]},{"source":"euvd","sourceId":"EUVD-2025-211059","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211059","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2025-211059","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211059"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_data_foundation_4:odf4/odf-multicluster-rhel9-operator","product":"odf4/odf-multicluster-rhel9-operator as a component of Red Hat Openshift Data Foundation 4","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odf-multicluster-rhel9-operator?repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_gitops:openshift-gitops-1/argocd-agent-rhel9","product":"openshift-gitops-1/argocd-agent-rhel9 as a component of Red Hat OpenShift GitOps","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/argocd-agent-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_gitops:openshift-gitops-1/argocd-image-updater-rhel9","product":"openshift-gitops-1/argocd-image-updater-rhel9 as a component of Red Hat OpenShift GitOps","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/argocd-image-updater-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_gitops:openshift-gitops-1/argocd-rhel9","product":"openshift-gitops-1/argocd-rhel9 as a component of Red Hat OpenShift GitOps","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/argocd-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_gitops:openshift-gitops-1/gitops-rhel9","product":"openshift-gitops-1/gitops-rhel9 as a component of Red Hat OpenShift GitOps","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/gitops-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]},{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json","productId":"red_hat_openshift_gitops:openshift-gitops-1/gitops-rhel9-operator","product":"openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps","status":"known_affected","remediations":[{"category":"workaround","details":"To reduce exposure to brute-force attempts against authentication endpoints:\n\n1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: \"false\"` within the `argocd-cm` ConfigMap.\n2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.\n3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.\n\nCaveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/gitops-rhel9-operator?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator","origins":[{"source":"redhat","sourceId":"CVE-2025-61560","modified":"2026-10-20T19:04:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61560.json"}]}],"vendorCoverage":{"total":6,"shown":6,"omitted":0,"source":"redhat"}}