CVE-2025-61560
Description
A flaw was found in Argo CD. A race condition in the SessionManager component allows a remote attacker to bypass rate limiting protections by sending concurrent requests. Consequently, an attacker can conduct automated brute-force attacks against user accounts without being blocked.
Statement
This vulnerability is rated as Moderate because exploiting the flaw requires winning a timing race condition with concurrent requests and only aids in credential guessing against local accounts, rather than permitting arbitrary code execution or direct privilege elevation. In Red Hat OpenShift GitOps deployments configured with OpenShift OAuth or enterprise Single Sign-On (SSO), native authentication rate limiting is avoided because requests are authenticated by the external provider. Environments utilizing built-in local credentials carry higher exposure, though an attacker still needs to successfully identify valid credentials.
Mitigation
To reduce exposure to brute-force attempts against authentication endpoints:
1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap.
2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules.
3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer.
Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
