Argo CD: Login rate limit bypass via concurrent requests
Summary
Argo CD, a GitOps continuous delivery tool for Kubernetes, limits failed local username/password logins (default: 5 failures in 5 minutes). The login handler reads the failure count, checks the password and only then increments the count, so concurrent login requests for the same username can exceed the limit. An attacker who can reach the login endpoint can therefore brute-force local accounts, including the built-in admin account if enabled. SSO and OIDC logins are not affected.
Affected
- Argo CD v3.0.6 according to the NVD description (not verified).
- According to the GitHub advisory: Argo CD 1.5.3 to below 2.0.0, 3.0.0 to below 3.3.15, 3.4.0 to below 3.4.10, 3.5.0 to below 3.5.4, and 3.6.0-rc1. The advisory states that all versions from v1.5.3 onward are affected.
- Unknown: the exact affected range for 3.0.x; verify in the advisory.
Fixed in
- 3.3.15
- 3.4.10
- 3.5.4
- 3.6.0-rc2
Argo CD 1.x, 2.x and 3.0 through 3.2 are out of support and will not receive a patch. Upgrade to a patched 3.3 or newer release.
Workaround
- Disable local accounts and require SSO (this removes the password check the limit applies to).
- Disable the built-in admin account with admin.enabled: "false" in argocd-cm.
- Disable other local accounts with accounts.<username>.enabled: "false".
- Where local accounts must stay enabled, use strong, unique passwords.
- Restrict network access to the API or put an HTTP rate limit in front of it. These measures do not fix the race condition.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Not listed as known exploited in CISA KEV (according to Strix). EPSS: 0.00318.
- No public proof of concept found in research; this does not prove none exists.
Our recommendation
- Upgrade to 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2 or later, and plan a move off unsupported 1.x, 2.x and 3.0 to 3.2 releases.
- Apply the whole release batch, not only this CVE.
- Check whether the Argo CD UI and API are reachable from the internet; restrict access to VPN or internal networks.
- Use SSO with MFA and disable local and admin accounts where possible.
- Add rate limiting at the ingress or WAF and monitor logs for repeated failed logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4439-h7jw-5cjj github.com
- Argo CD releases github.com
- Argo CD repository github.com
- Red Hat CVE record via Vulners vulners.com
- Strix CVE overview www.strix.ai
- Argo CD commit on admin account documentation github.com
- Argo CD advisory GHSA-2vgg-9h6w-m454 (earlier rate-limit bypass) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:23.
Original description (NVD)
A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.