Vulnerability Description
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/argoproj/argo-rollouts
- https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d783
- https://github.com/argoproj/argo-rollouts/issues/4747
- https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mut
FAQ
What is CVE-2026-82277?
CVE-2026-82277 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invo...
How severe is CVE-2026-82277?
CVE-2026-82277 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-82277?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.