EUVD-2026-67808
GHSA-366v-5xmx-36vh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description scopes reach to 'same network' (AV:A); no auth or CSRF control (PR:N/UI:N); dashboard privileges act on separate cluster workloads, so scope change (S:C) with high C/I/A via image control.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
AnalysisAI
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Argo Rollouts dashboard/API server is actually running and that its listening port (bound to all interfaces, 0.0.0.0) is reachable by the attacker - the description scopes this to 'attackers on the same network,' i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) reflects a low-complexity, unauthenticated, high-impact flaw, consistent with CWE-306 and the absence of any auth/CSRF control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is confirmed in the provided data (the references point to a GitHub issue and source file, not a tagged release), so upgrade to a fixed release once argoproj publishes one and monitor issue #4747. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the Argo Rollouts dashboard (port 3100) to trusted administrative networks only using firewall rules or Kubernetes NetworkPolicy; disable external exposure entirely if not required for operational workflow. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today