CVE-2025-59531: argo cd from 1.2.0 (inclusive), through 1.8.7 (inclusive), from 2.0.0 (inclusive), before 2.14.20 (exclusive), from…

Affected technology

argo cd · from 1.2.0 (inclusive), through 1.8.7 (inclusive)
argoproj

argo cd · from 2.0.0 (inclusive), before 2.14.20 (exclusive)
argoproj

argo cd · from 3.0.0 (inclusive), before 3.0.19 (exclusive)
argoproj

argo cd · from 3.1.0 (inclusive), before 3.1.8 (exclusive)
argoproj

argo cd · 3.2.0 · update rc1
argoproj

argo-cd · >= 1.2.0, <= 1.8.7, >= 2.0.0-rc1, < 2.14.20, >= 3.2.0-rc1, < 3.2.0-rc2, >= 3.1.0-rc1, < 3.1.8, >= 3.0.0-rc1, < 3.0.19
argoproj

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.