CVE-2025-61560: Race Condition
Published Oct 9, 2026
·Updated
A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.
Affected Software
1 affected component
CNCF Argo CD=3.0.6
Event History
Oct 9, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
An attacker needs to send repeated crafted requests to the Argo CD SessionManager. The race condition can let those requests bypass rate limiting and support brute-force attempts.
2
What is the practical security impact?
The issue weakens the intended rate-limiting protection on session-related requests, enabling brute-force attack activity. The provided information does not identify affected deployment configurations, default exposure, or mitigations when patching is unavailable.