argocd-mcp CVE-2026-82456

Two concrete prerequisites: (1) ARGOCD_API_TOKEN is configured on the argocd-mcp 0.8.0 instance - this is the normal operating mode and is what causes sessions to be accepted without caller credentials; and (2) the attacker has network reachability to the HTTP listener, which is exposed because the transport binds to all interfaces (0.0.0.0) rather than loopback. No authentication, user interaction, or special client is required once reachable. The primary limiting factor is network exposure: if the port is firewalled or bound only to loopback/an internal segment, remote exploitation is blocked despite the auth bypass.

All signals point to top-tier priority where the component is exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact across C/I/A) describes trivial, unauthenticated, remote, no-interaction exploitation, consistent with the description; the 10.0 score is credible because a single request yields full control of Argo CD, which in turn controls Kubernetes application deployment. No EPSS score, KEV entry, or POC was provided, so exploitation is currently 'no public exploit identified at time of analysis' - that lowers the immediacy somewhat but not the severity, since the flaw is a straightforward auth bypass that requires no exploit craft. The dominant limiting factor is network exposure: risk is critical if the listener is reachable from untrusted networks and materially lower if it is bound behind loopback or restricted networking. Given the GitOps blast radius, even a small operator team should treat a reachable instance as urgent and verify listener exposure immediately.

An attacker who can route to the argocd-mcp port (for example a co-tenant on the cluster network, a pivoted host, or an instance inadvertently exposed to the internet) opens an MCP session without supplying any credential. Using the operator's stored Argo CD token that the server holds, they invoke tools to create a malicious Application pointing at attacker-controlled manifests and request a sync, achieving deployment into the cluster. No public POC is referenced, but the auth bypass requires no exploit development.