What is CVE-2026-82277?

CVE-2026-82277 is a critical-severity vulnerability in Argoproj Argo-Rollouts, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-08-28.

How severe is CVE-2026-82277?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Argoproj Argo-Rollouts

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Argoproj Argo-rollouts

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82277?: CVE-2026-82277 is a critical-severity vulnerability in Argoproj Argo-Rollouts, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-08-28.
How severe is CVE-2026-82277?: Critical severity. CVSS v3 base score is 9.8 out of 10.