RHSA-2026:83602HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.22.2 security update

Published
October 15, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (1)

CVE-2025-61560 →

📋 Description

CVE-2025-61560 — github.com/argoproj/argo-cd: argo-cd: Rate limit bypass via race condition in SessionManager

🎯 Affected products54

  • Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:4ffcf2a01608abca545ff8507af62e64176bae49837d623012868d98ea2dc1d0_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:af9e88e52587c560ac3d080113f4fb2224a8910d6f21d4f5e0bbadfb3ad06402_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:ea697becf01289e087296a183b5fc03ed4669cb44fdabec433909d3fff69ce33_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:ef708282223959f3ca691155fae8641822eec1f50faf4839edcfbfaa5eff7117_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:4cef4a3651c7219d4d9d7e106bf3166d6f917b3e1806fca016c7d19f7fc4bb3a_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:6ab5cb7ec744ad828973ee490872448842e738b8609fcde20a04e55d2954cc29_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:c3cf248e0a3b9a0471a820203dae796279ba21880322de383d8f21112ecf5068_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f15e9be47a0943853a404bd85ba790d5b93e4bf813e8bac797ed951ecf11d5d8_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:2cede32de58468022f22cdf0ba29e247e0c7ecf99811509a180b5b388a0cf988_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4f7d8b29111f2b362f21c2f260894265382e1a8c58ce206d403cc9ea1eaf9088_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:53a1801a910c5bf2404337e5d8637b33f66ac049028cdae435248da015a8fe06_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:cab79cd4914e89841359cec012274c2e0c3f5e33b490905b6782a0211913f33f_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:0aea3db1f31674d3114325ff4e503c18c6b15e56f3d62ad21c2cc300c9495144_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:59dbb3178cc92d563748f5266292f8b1e5d1159601bebdb1bc124c03a8f1f995_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:bd99afeadcbd789ad8dd7f93a7b88a2a1ea27b2155892ddb9799abea558112ec_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:d5c1d20527ac83e72ee73a7b2120e40a7cf9aea069bb807a47da55dddc2c3f46_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:0cf38846853443060a5ddd39e4b5f97339d4b3abb697ff23eadec90683093293_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:2c9d5033587c26e29580af560d5d6fe394efe43f2e2fb956906bee6bb95977b8_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:9cbdbd1f67999eb205ff5047f96b6d9f9987bbe5f53fb011d03d23cf23778a43_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-promoter-extension-rhel9@sha256:f79467ff3c296f91f5576d67bb0fa50c201be9fca78f1bb86fb8c7b534d67f56_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:523d9f9ec9832005a4bb99f8c99dfb62f03a7c3224157875ed4617e2a4f924a4_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:742ab1d4784f69e05cdf9668b03842987bf4bbb67fa00d68a0f18b33583c1277_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:895b1b2e7b6cf10f1e85ddc1652f15fac2adc47fae1762a731ae4855a45fd447_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:a82f8ec909e149f97b51038abe5f18cf0b0be022ee25c845e8f2e3cfb80f5769_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:16f3d62aeaf529b6f6528d5141c6d541528fbd6c03576c169413284d01f1aeab_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:37104f0feb939f926f5004b14470e03f434a3559d32fdef119eae152a562ee07_arm64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:5b763ceb519d78818e085d71fa8b4f9edb74764b45054a3b9f526f4e886352a5_s390x as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/console-plugin-4-18-rhel9@sha256:cdf9490f8a29683f132ae02e84a8a0a4c868014415db927de1c908ce35d8066a_amd64 as a component of Red Hat OpenShift GitOps 1.22
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7633955b9a361ae8d1139207e2b775eda9bc51eecb58623443be0a788ffbf559_ppc64le as a component of Red Hat OpenShift GitOps 1.22
  • +24 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce exposure to brute-force attempts against authentication endpoints: 1. Rely on an external identity provider (such as Red Hat OpenShift OAuth or an enterprise SSO/OIDC provider) and disable the built-in local admin account by setting `admin.enabled: "false"` within the `argocd-cm` ConfigMap. 2. Restrict network access to the Argo CD API and web console to trusted internal networks using NetworkPolicies or firewall rules. 3. Enforce connection rate limiting at an upstream reverse proxy or ingress layer. Caveat: Disabling local accounts requires an operational external identity provider; ensure SSO is functional prior to disabling local authentication to avoid administrative lockout. Modifying the `argocd-cm` ConfigMap or ingress routing configuration may trigger a pod restart or reload of Argo CD server components.

🔗 References (5)