Security advisory2026-10-09A race condition vulnerability in the SessionManager of CNCF projectSecurity advisory

Software component issue could cause actions to run with inconsistent state

A public security advisory describes this issue. Review the linked source for the technical details and remediation guidance.

What happened

  • A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.Security Advisory CVE-2025-61560
  • A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.Advisory description (CVE-2025-61560)

Contributing factors stated by the source

  • A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

The failure pattern

Duplicate action after an ambiguous resultA request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.How to prevent it Automation acts on stale state or authorizationA background job or automation acts on a plan, permission or record that changed after it was read.How to prevent it
Watch the pattern: Duplicate action after an ambiguous result

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern