Read the docs

argoproj-labs

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

argoproj-labs records in CISA KEV

No argoproj-labs vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-56852 CVE-2026-82456 · GHSA-p2x5-x87w-v2xj

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

Priority HIGH 82

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02367 Published 2026-08-29 Fixed in 0.9.0 CWE-1327
TI-2026-70573 CVE-2026-108585 · GHSA-f7cg-qc77-hh95

Path traversal in argocd-mcp delete_application tool

Priority LOW 24

argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00287 Published 2026-10-10 No fix listed CWE-22
Open these records in search →