A race condition exists in the SessionManager of Argo CD version 3.0.6. This flaw allows an attacker to send crafted requests that bypass the built‑in rate limiting controls, facilitating repeated authentication attempts at a speed far above the intended limits. The primary consequence is the ability to perform brute‑force credential guessing against the Argo CD API. Based on the description, it is inferred that compromising legitimate credentials could grant the attacker access to the cluster or resources managed by Argo CD, but such downstream impacts are not explicitly stated in the advisory.

The affected product is Argo CD, specifically release version 3.0.6 for the Cloud Native Computing Foundation. No other versions or vendor variants are enumerated; only installations using exactly that release are vulnerable.

The CVSS score of 8.1 indicates significant severity, but the EPSS score is below 1% and the vulnerability is not catalogued in CISA’s KEV list, suggesting a low current exploitation probability. The flaw can be exploited remotely via the Argo CD API server, with repeated crafted requests. The likelihood of successful brute‑force attacks depends on the presence of a password or other credential on the targeted account, but the rate‑limit bypass dramatically increases the attack success window.