Read the docs
TI-2025-43897 Aliases CVE-2025-61560

Argo CD SessionManager race condition allows rate limit bypass and brute force

Priority LOW 37CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Argo CD v3.0.6 is affected. A race condition in the SessionManager, classified as CWE-362, lets remote attackers bypass rate limiting. Without authentication, an attacker can send repeated crafted requests to brute force credentials. The flaw is rated high severity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

Red Hat OpenShift GitOps 1.20 is fixed in 1.20.8 through RHSA-2026:77273. Red Hat OpenShift GitOps 1.21 is fixed in 1.21.5 through RHSA-2026:77269. Red Hat OpenShift GitOps 1.22 is fixed in 1.22.1 through RHSA-2026:77267 and in 1.22.2 through RHSA-2026:83602.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 4 advisories

  • RHSA-2026:83602 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.22.2 security update
    • Red Hat OpenShift GitOps 1.22 registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9
  • RHSA-2026:77273 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.8 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
Show 1 more Red Hat advisories
  • RHSA-2026:77267 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.22.1 security update
    • Red Hat OpenShift GitOps 1.22 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:77273
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Red Hat OpenShift GitOps 1.22Fixed RHSA-2026:77267, RHSA-2026:83602
Not affected: 5 products
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift GitOps 1.22
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-09 Threatist record created from CVE-2025-61560
  2. 2026-10-19 CVSS score added · CISA ADP
  3. 2026-10-19 Weakness changed · CISA ADP
  4. 2026-10-19 CISA SSVC decision points changed
  5. 2026-10-21 Affected versions changed · Red Hat
  6. 2026-10-21 CVSS score added · Red Hat
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-11-03 Fix available: RHSA-2026:83602 · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:90323 · Red Hat
  10. 2026-11-03 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.22 · Red Hat
  11. 2026-11-05 Fix available: Red Hat OpenShift GitOps 1.21 · Red Hat
  12. 2026-11-05 Affected versions changed · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:77267 · Red Hat
  14. 2026-11-06 Fix available: RHSA-2026:77269 · Red Hat
  15. 2026-11-06 Fix available: RHSA-2026:77273 · Red Hat

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences