What is CVE-2025-59537?

CVE-2025-59537 is a high-severity vulnerability in Argoproj Argo-cd, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2025-10-01.

How severe is CVE-2025-59537?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-59537 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

NULL pointer dereference in Argoproj Argo-cd

CVE-2025-59537

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the A…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (53.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Argoproj Argo-cd — versions >= 1.2.0, <= 1.8.7, >= 2.0.0-rc1, < 2.14.20, >= 3.2.0-rc1, < 3.2.0-rc2

Weakness classification (CWE)

Public proof-of-concept exploits

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2 (x_refsource_CONFIRM)
https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43 (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-59537?: CVE-2025-59537 is a high-severity vulnerability in Argoproj Argo-cd, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2025-10-01.
How severe is CVE-2025-59537?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-59537 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.