CVE-2025-61560: Race Condition

Published Oct 9, 2026

Updated

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

Affected Software

1 affected component

CNCF Argo CD=3.0.6

Event History

Oct 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker needs to send repeated crafted requests to the Argo CD SessionManager. The race condition can let those requests bypass rate limiting and support brute-force attempts.

What is the practical security impact?

The issue weakens the intended rate-limiting protection on session-related requests, enabling brute-force attack activity. The provided information does not identify affected deployment configurations, default exposure, or mitigations when patching is unavailable.

CVE-2025-61560: Race Condition

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical security impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical security impact?