Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82456

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

CVSS 4.0 10.0 CRITICALCVSS 3.1 10.0 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82456

Published

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82456

Published

argocd-mcp

https://github.com/argoproj-labs/mcp-for-argocd

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "argoproj-labs",
                    "product": "argocd-mcp",
                    "collectionURL": "https://github.com/argoproj-labs/mcp-for-argocd",
                    "repo": "https://github.com/argoproj-labs/mcp-for-argocd",
                    "versions": [
                        {
                            "version": "0.8.0",
                            "lessThan": "0.9.0",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON