argocd-mcp CVE-2026-108585

Requires a running argocd-mcp server (version through 0.9.0) connected to an Argo CD instance with a valid API token loaded (PR:L), and the ability to invoke the delete_application tool - either as a direct MCP client or indirectly via prompt injection of an LLM connected to the server. The malicious trigger is an applicationName containing dot-segments (e.g. '../repositories/') that smuggles the request onto a different Argo CD API route. Limiting factors: no special non-default configuration is needed, but impact is strictly bounded by the token's RBAC permissions (a read-only or application-scoped token cannot delete repositories/clusters/projects), the MCP server must be deployed and token-authenticated, and there is no confidentiality exposure - only deletion of resources the token is already permitted to modify.

The input provides only a CVSS 4.0 vector (5.3, Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N; no CVSS 3.1 vector is supplied. Signals indicate network reach (AV:N) with low attack complexity (AC:L) but authenticated access (PR:L): the argocd-mcp server must already hold a valid Argo CD API token, so this is not an unauthenticated remote flaw. Impact is bounded - no confidentiality loss (VC:N) and only low integrity/availability impact (VI:L/VA:L) constrained to whatever the token's RBAC role permits. No EPSS score is present in the input and there is no CISA KEV listing, so there is no confirmed active exploitation. A VulnCheck advisory plus a public hackMD technical writeup and direct source-code references exist, meaning the technique is documented, but no packaged public exploit is flagged in the input. The most important real-world amplifier is the prompt-injection angle explicitly called out in the description: in agentic deployments an attacker who can influence the LLM's input - not just a direct MCP client - can trigger destructive DELETEs, which raises practical risk above what the raw 5.3 suggests for teams running this in automated pipelines. Net: a genuine but moderate, authentication- and RBAC-gated issue, elevated for agentic/LLM-exposed deployments and lower for tightly scoped tokens; EPSS data is missing and should be verified before final prioritization.

An attacker with access to the MCP client, or who can inject a crafted prompt into an LLM wired to the argocd-mcp server, invokes the delete_application tool with applicationName set to a dot-segment value such as '../repositories/<repo>'. Because the value is concatenated into the API path without validation, the server issues an authenticated DELETE to an unintended Argo CD endpoint, destroying repositories, clusters, or projects within the token's RBAC scope. No packaged public exploit is identified in the input, though a VulnCheck advisory and a hackMD writeup describe the route-smuggling technique in detail.