Argo Rollouts CVE-2026-82277

Exploitation requires that the Argo Rollouts dashboard/API server is actually running and that its listening port (bound to all interfaces, 0.0.0.0) is reachable by the attacker - the description scopes this to 'attackers on the same network,' i.e. network-adjacent reach to the dashboard host. No credentials, tokens, or authorization are needed once the port is reachable, and no user interaction is required for the direct network vector (though the CSRF vector instead requires an authenticated operator to visit a malicious page while the dashboard is up). Limiting factors: the dashboard is often run transiently on an operator's localhost rather than persistently exposed, so risk drops sharply when it is bound to loopback or firewalled; the achievable actions are bounded to Rollout mutating operations within the namespaces the operator's kubeconfig can access.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) reflects a low-complexity, unauthenticated, high-impact flaw, consistent with CWE-306 and the absence of any auth/CSRF control. However, the description states 'attackers on the same network,' which points to adjacent-network (AV:A) reachability rather than true internet-wide exposure - the practical attack surface depends on whether the dashboard port is exposed beyond localhost, and it is typically run ad hoc by operators rather than as a persistent internet-facing service. This tempers real-world risk: high technical impact but likely opportunistic/adjacent rather than mass-exploitable, unless a dashboard is deliberately exposed. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; the CSRF tag indicates a viable browser-driven vector where an operator with the dashboard open visits a malicious page. Treat as a genuine high priority for teams that run the dashboard on shared networks, but the raw 9.3 overstates risk for the common localhost-only usage pattern.

An attacker on the same LAN or Wi-Fi as an operator running the Argo Rollouts dashboard scans for the open port, then sends a SetRolloutImage request to replace a production canary image with an attacker-controlled container, gaining code execution inside the cluster under that workload's service account. Alternatively, leveraging the missing CSRF protection, the attacker lures the operator to a malicious webpage that silently issues AbortRollout/PromoteRollout requests to the dashboard on localhost. No POC is referenced, but the low complexity and absence of authentication make exploitation straightforward once the endpoint is reachable.