CVE-2025-55191 describes a race condition in the Argo CD GitOps tool's repository credentials handler. When concurrent operations target the same repository URL, the server may panic and crash, resulting in a denial of service. Triggering this requires a valid API token with create, update, or delete permissions on repository resources. The vulnerability affects Red Hat OpenShift GitOps versions >=1.18.0 and <1.18.1. The issue is tracked under Red Hat Bugzilla 2400562 and fixed in version 1.18.1. The vulnerability is classified under CWE-362 (race condition) and related CWEs. The availability impact is limited to the Argo CD server process; the underlying host is not compromised. Red Hat has released an official security advisory and update to remediate this vulnerability.

The vulnerability can cause the Argo CD server to crash due to a race condition when handling repository credentials during concurrent operations on the same repository URL. This leads to a denial of service affecting the availability of the Argo CD server. The host system running Argo CD is not affected. No confidentiality or integrity impacts are reported. Exploitation requires valid API tokens with repository resource permissions, limiting the attack surface.

An official security update to Red Hat OpenShift GitOps version 1.18.1 is available and should be applied to remediate this vulnerability. Prior to applying this update, ensure all previously released errata relevant to your system are installed. Systems configured to automatically restart the Argo CD service upon crash may partially mitigate availability impact but do not replace applying the official fix. Refer to Red Hat's advisory and documentation for update procedures.