Vulnerability Description
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/argoproj-labs/mcp-for-argocd
- https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x
- https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-
- https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x
FAQ
What is CVE-2026-82456?
CVE-2026-82456 is a vulnerability with a CVSS score of 10.0 (CRITICAL). argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the list...
How severe is CVE-2026-82456?
CVE-2026-82456 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-82456?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.