VDB
GO-2025-3993
GO-2025-3993
PUBLISHED
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | argoproj/argo-cd/v3 | 3.0.0-rc1, 3.1.0-rc1, 3.2.0-rc1 |
| github.com | argoproj/argo-cd | 1.2.0 |
| chainguard | argo-cd-2.13 | 0 |
| github.com | argoproj/argo-cd/v2 | 0 |
Timeline
- Oct 23, 2025 CVE Published
- Apr 20, 2026 CVE Updated
- Oct 14, 2026 Security Advisory