Argocd Mcp
Monthly
Unauthenticated remote control of Argo CD in argocd-mcp 0.8.0, the Model Context Protocol server for Argo CD, arises because the HTTP transport binds to all network interfaces and accepts MCP sessions without any caller credential once ARGOCD_API_TOKEN is set. Any attacker with network reach to the listener can drive the full MCP tool surface under the operator's stored token to create applications, trigger syncs, and mutate Argo CD resources. Rated CVSS 10.0 by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in the argocd-mcp (Argo CD MCP Server) delete_application tool through 0.9.0 allows authenticated MCP clients to smuggle single DELETE requests onto unintended Argo CD API routes, so an applicationName value such as '../repositories/' can cause deletion of repositories, clusters, or projects instead of an application. The attacker must be a valid MCP client - or an LLM manipulated by prompt injection - operating with a token that already carries the corresponding RBAC permissions, so it is authenticated (PR:L) and impact is bounded to destructive writes (I:L/A:L) with no confidentiality exposure. No CISA KEV listing or public exploit code has been flagged in the available intelligence, though a public technical writeup and the implicated source lines are referenced; CVSS 4.0 rates this 5.3 (Medium) and the independent 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
Unauthenticated remote control of Argo CD in argocd-mcp 0.8.0, the Model Context Protocol server for Argo CD, arises because the HTTP transport binds to all network interfaces and accepts MCP sessions without any caller credential once ARGOCD_API_TOKEN is set. Any attacker with network reach to the listener can drive the full MCP tool surface under the operator's stored token to create applications, trigger syncs, and mutate Argo CD resources. Rated CVSS 10.0 by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in the argocd-mcp (Argo CD MCP Server) delete_application tool through 0.9.0 allows authenticated MCP clients to smuggle single DELETE requests onto unintended Argo CD API routes, so an applicationName value such as '../repositories/' can cause deletion of repositories, clusters, or projects instead of an application. The attacker must be a valid MCP client - or an LLM manipulated by prompt injection - operating with a token that already carries the corresponding RBAC permissions, so it is authenticated (PR:L) and impact is bounded to destructive writes (I:L/A:L) with no confidentiality exposure. No CISA KEV listing or public exploit code has been flagged in the available intelligence, though a public technical writeup and the implicated source lines are referenced; CVSS 4.0 rates this 5.3 (Medium) and the independent 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.