CVE-2025-61560

A flaw was found in Argo CD. A race condition in the SessionManager component allows a remote attacker to bypass rate limiting protections by sending concurrent requests. Consequently, an attacker can conduct automated brute-force attacks against user accounts without being blocked. Mitigation To...

Race Condition

Overview github.com/argoproj/argo-cd/v3/util/session is a Declarative continuous deployment for Kubernetes. Affected versions of this package are vulnerable to Race Condition through a race condition in the SessionManager process. An attacker can bypass rate limiting and perform unauthorized brut...

Race Condition

Overview github.com/argoproj/argo-cd/util/session is a Declarative continuous deployment for Kubernetes. Affected versions of this package are vulnerable to Race Condition through a race condition in the SessionManager process. An attacker can bypass rate limiting and perform unauthorized brute...

Race Condition

Overview github.com/argoproj/argo-cd/v2/util/session is a declarative, GitOps continuous delivery tool for Kubernetes. Affected versions of this package are vulnerable to Race Condition through a race condition in the SessionManager process. An attacker can bypass rate limiting and perform...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability exists in the SessionManager of Argo CD , specifically affecting the component github.com/argoproj/argo-cd/v3/util/session. This flaw allows an attacker to bypass rate limiting and execute a brute force attack by sending repeated, crafted requests. To remediate this...

CVE-2025-61560: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

EUVD-2025-211059

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

PT-2026-108972

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2026-105792 Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/taskresult/taskname endpoint calls SessionManager.getresultbytask in ufo/server/services/sessionmanager.py, which acquires a non-reentrant lock and then calls...

CVE-2026-105792

Prior to version 3.0.9 , the Microsoft UFO framework is vulnerable to a deadlock condition in its session manager. The /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and subsequently at...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

EUVD-2025-10700

Malicious code in bioql PyPI...

CVE-2025-22232

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

CVE-2025-22232

Summary: CVE-2025-22232 affects Spring Cloud Config Server when used with Vault and X-CONFIG-TOKEN. The issue arises because the default SessionManager (LifecycleAwareSessionManager or similar) persists the first Vault token it retrieves and continues using it, even if clients send a different to...

CVE-2025-22232 Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

CVE-2025-22232: Improper Authentication

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...