PT-2026-83435

CVE-2026-82456

Published

2026-08-29

Updated

2026-09-18

Description by

CVSS 4.0

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions argocd-mcp version 0.8.0

Description The software binds its HTTP transport to every network interface (0.0.0.0) and accepts MCP sessions without requiring caller credentials when the ARGOCD API TOKEN variable is configured. This allows a network-reachable attacker to utilize the operator's stored token to invoke the full tool surface, enabling the creation of applications, requesting syncs, and modification of Argo CD resources.

Recommendations Upgrade to version 0.9.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1327: Binding to an Unrestricted IP Address

Related identifiers

CVE-2026-82456