CLEANSTART-2026-FS21502 Security fixes in argo-rollouts-fips 1.9.1-r2

Package argo-rollouts-fips version 1.9.1-r2 fixes 9 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CLEANSTART-2026-IH82648 Security fixes in argo-rollouts-fips 1.9.1-r1

Package argo-rollouts-fips version 1.9.1-r1 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-41178...

CLEANSTART-2026-EI29741 Security fixes in argo-rollouts-fips 1.9.1-r3

Package argo-rollouts-fips version 1.9.1-r3 fixes 9 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

EUVD-2026-67808

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all network interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection . Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and Retry...

PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, bento-fips, argo-events-fips, atlantis-fips, kubernetes-event-exporter, kubewatch, ory-kratos, argo-cd, kubernetes-event-exporter-fips, ory-kratos-fips, argo-rollouts-fips, argo-rollouts, kyverno-policy-reporter-fips, bento, goreleaser,...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: tempo, opentelemetry-collector, kubeflow-pipelines, amazon-cloudwatch-agent-fips, keda, opentelemetry-collector-contrib, kargo, argo-cd, opentelemetry-collector-contrib-fips, argo-rollouts-fips, nats, argo-rollouts, eks-distro-fips, argo-workflows,...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, argo-cd, argo-events, atlantis, argo-rollouts, kubewatch, kubernetes-event-exporter, goreleaser, bento...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: nats, splunk-otel-collector, tempo, amazon-cloudwatch-agent, k8sgpt, kargo, opentelemetry-collector, argo-rollouts, opentelemetry-collector-contrib, grafana-alloy, argo-workflows, kubeflow-pipelines...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: trufflehog, aws-nuke, guac, envconsul, kubeflow-katib, xeol, kbld, multus-cni, podinfo, sftpgo-plugin-auth, argo-rollouts, pinact, prometheus, secrets-store-csi-driver, src-fingerprint, witness, crossplane-provider-aws-route53, kaniko, runc, spire-server,...

CLEANSTART-2026-SZ84105 Security fixes in argo-rollouts-fips 1.9.0-r0

Package argo-rollouts-fips version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-93mq-9ffx-83m2, ghsa-cfpf-hrx2-8rv6, ghsa-gxhx-2686-5h9g, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-IL70948 Security fixes in argo-rollouts 1.9.0-r0

Package argo-rollouts version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3, ghsa-93mq-9ffx-83m2, ghsa-pc3f-x583-g7j2, ghsa-cfpf-hrx2-8rv6...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: eck-operator, rke2-runtime-fips, k3s, cert-manager-istio-csr, cloudbeat, rancher-support-bundle-kit, falcoctl, kubevela, gitlab-kas, plugin-barman-cloud, percona-xtradb-cluster-operator, consul-k8s-fips, redis-operator-fips, kubernetes-dashboard-api,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: trufflehog, guac, xeol, grype, witness, argo-rollouts, src-fingerprint, syft, argo-workflows, crossplane-provider-aws-route53, wal-g, actions-runner-controller, helm-push, crossplane-provider-aws-sns, crossplane-provider-keycloak, trivy-operator, argocd-image-updater...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: trufflehog, guac, xeol, grype, witness, argo-rollouts, src-fingerprint, syft, argo-workflows, crossplane-provider-aws-route53, wal-g, actions-runner-controller, helm-push, crossplane-provider-aws-sns, crossplane-provider-keycloak, trivy-operator, argocd-image-updater...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps 1.16.1 security release

Errata advisory for Red Hat OpenShift GitOps 1.16.1 security release. The Red Hat OpenShift GitOps 1.16.1 release provides security updates to the Argo CD CLI, Argo Rollouts CLI and MicroShift GitOps. Security Fixes: openshift-gitops-1/argocd-rhel9: Improper URL Sanitization in Argo CD Repository...