tocsin

Go/github.com/argoproj/argo-cd/v3 CVE-2025-59531: high 7.5, EPSS 0.59%

Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

Action: Upgrade github.com/argoproj/argo-cd/v3 to 3.0.19 or later.

go get github.com/argoproj/argo-cd/v3@v3.0.19
go get github.com/argoproj/argo-cd/v3@v3.1.8
go get github.com/argoproj/argo-cd/v3@v3.2.0-rc2

Affected

introducedfixedlast affected
3.0.0-rc13.0.19-
3.1.0-rc13.1.8-
3.2.0-rc13.2.0-rc2-

Fixed versions

3.0.193.1.83.2.0-rc2

Sources

CVE-2025-59531 · published · modified · JSON