Vulnerabilidades de Argoproj-labs
CVEs publicadas que afetam produtos de Argoproj-labs: 2 registro(s), com severidade, exploração e correções.
CVE-2026-108585
Média · 5.4
CWE-22 10/10/2026
argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.
CVE-2026-82456
Crítica · 10.0
CWE-1327 29/08/2026
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.