Argo CD CVE-2025-61560

Exploitation requires reaching the Argo CD SessionManager authentication/login endpoint over the network and issuing repeated concurrent crafted requests to win the race-condition timing window that governs the login rate-limiting counter; this is the exact prerequisite named in the advisory. No authentication or user interaction is needed to trigger the bypass (PR:N/UI:N), but realistic account compromise is LIMITED by two factors: the attacker must reliably win the timing race (reflected as AC:H / high attack complexity), and the follow-on brute force only succeeds against weak, default, or guessable credentials - strong passwords, SSO/external identity providers that remove the local password login, or secondary account lockout controls materially reduce exploitability. Affected: Argo CD v3.0.6 (verify fixed version via GHSA-4439-h7jw-5cjj).

The CVSS 3.1 base score of 8.1 is driven by a fully network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) vector with claimed High confidentiality, integrity and availability impact, but tempered by High attack complexity (AC:H) - appropriate for a race condition whose exploitation depends on winning a narrow timing window. The real-world signals pull the priority down: EPSS is only 0.15% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so this is 'no public exploit identified at time of analysis.' There is tension between the CVSS impact metrics and the described defect: the vulnerability itself only bypasses login rate limiting (CWE-362), while the C:H/I:H/A:H rating reflects the DOWNSTREAM consequence of a successful brute-force against an Argo CD account - it does not grant those impacts directly and still depends on guessable/weak credentials. Net assessment: a genuinely serious flaw in a widely deployed Kubernetes GitOps controller (admin takeover = cluster control), but a moderate rather than emergency priority given high exploit complexity, very low EPSS, no KEV, and no known exploit - patch on a normal-to-expedited cycle. Note the CPE/affected-version data in the feed is 'n/a' and unreliable; the only concrete affected version is v3.0.6 from the description - verify fixed version against the GHSA advisory.

A remote, unauthenticated attacker targets the Argo CD login/session endpoint and issues many concurrent crafted authentication requests to trigger the SessionManager race condition, causing the rate-limiting counter to be bypassed. With rate limiting defeated, the attacker runs a high-volume password brute-force against a known or guessed account (e.g., the built-in admin), and on success obtains authenticated access to Argo CD and the clusters it manages. No public proof-of-concept exploit was identified at the time of analysis, and the high attack complexity (AC:H) means the timing race must be won reliably.