CVE-2026-82456

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

State: Published
Severity: 10.0 Critical
Published: Aug 29, 2026
Updated: Sep 24, 2026
Reserved: Aug 29, 2026

Description

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-1327 Binding to an Unrestricted IP Address

Affected Products

Product	Versions
argocd-mcpargoproj-labs	0.8.0 to before 0.9.0Affected

References

GitHub Security Advisory (GHSA-rp45-5x3v-48mr)vendor-advisory
https://github.com/argoproj-labs/mcp-for-argocdproduct
VulnCheck Advisory: argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTPthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.