224 matches found
argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access
argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...
Argo CD Unauthenticated Access to sensitive setting
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. id: CVE-2024-37152 info: name: Ar...
CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
EUVD-2026-68103
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456
argocd-mcp version 0.8.0 (argoproj-labs) has an authentication bypass via its unauthenticated HTTP transport. The server binds to all network interfaces and accepts MCP sessions without requiring caller credentials when the ARGOCD_API_TOKEN environment variable is configured. Any network-reachabl...
CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
CVE-2026-82456: Binding to an Unrestricted IP Address
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...
PT-2026-83435
Name of the Vulnerable Software and Affected Versions argocd-mcp version 0.8.0 Description The software binds its HTTP transport to every network interface 0.0.0.0 and accepts MCP sessions without requiring caller credentials when the ARGOCD API TOKEN variable is configured. This allows a...
GO-2026-4942 vulnerabilities
Vulnerabilities for packages: envoy-gateway, zot, portieris, argocd-image-updater, kots, gitness...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kyverno, rancher, cluster-api-ipam-provider-in-cluster, telegraf, kuma, kubernetes-csi-external-snapshotter, cert-manager-istio-csr, gatekeeper, argocd-image-updater, spqr, rancher-agent, opentelemetry-operator, cluster-api-azure-controller, helm-operator,...
GO-2024-3277 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, aws-efs-csi-driver-fips, argocd-image-updater, aws-efs-csi-driver...
GO-2026-5185 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, envoy-gateway, zot, kots, argocd-image-updater-fips, gitlab-rails-ce, gitlab-rails-ce-fips, envoy-gateway-fips, gitness, portieris-fips, portieris...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: tigera-operator, kots, xeol, tigera-operator-fips, maru, trivy-fips, drone, kube-arangodb, helm-set-status, cert-manager-cmctl-fips, helm-exporter, cluster-api-helm-controller, k9s-fips, zarf, cert-manager-cmctl, gitlab-operator, teleport, trivy, chartmuseum-fips,...
GO-2026-5094 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, envoy-gateway, zot, kots, argocd-image-updater-fips, gitlab-rails-ce, gitlab-rails-ce-fips, envoy-gateway-fips, gitness, portieris-fips, portieris...
GO-2025-3433 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...
GO-2025-3437 vulnerabilities
Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater...