PT-2026-109675 · Argoproj · Argocd-Mcp

Haind

·

CVE-2026-108585

·

Publicado

2026-10-10

·

Atualizado

2026-10-10

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-108585

Produtos afetados

Argocd-Mcp