EUVD-2026-68103
GHSA-p2x5-x87w-v2xj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access with no interaction (PR:N/UI:N/AC:L); scope changes (S:C) because the MCP server abuses its stored token to fully compromise the separate Argo CD control plane.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
AnalysisAI
Unauthenticated remote control of Argo CD in argocd-mcp 0.8.0, the Model Context Protocol server for Argo CD, arises because the HTTP transport binds to all network interfaces and accepts MCP sessions without any caller credential once ARGOCD_API_TOKEN is set. Any attacker with network reach to the listener can drive the full MCP tool surface under the operator's stored token to create applications, trigger syncs, and mutate Argo CD resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites: (1) ARGOCD_API_TOKEN is configured on the argocd-mcp 0.8.0 instance - this is the normal operating mode and is what causes sessions to be accepted without caller credentials; and (2) the attacker has network reachability to the HTTP listener, which is exposed because the transport binds to all interfaces (0.0.0.0) rather than loopback. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to top-tier priority where the component is exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed release identified in the GitHub Security Advisory GHSA-rp45-5x3v-48mr (https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr); an exact patched version number is not included in the provided data, so confirm the fixed tag from that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory systems running argocd-mcp 0.8.0; immediately restrict network access to the MCP listener via firewall rules to authorized internal networks only; evaluate whether the service can be temporarily disabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1327 – Binding to an Unrestricted IP Address
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today