What is CVE-2026-82456?

CVE-2026-82456 is a critical-severity vulnerability in Argoproj-Labs Argocd-Mcp, classified under CWE-1327. CVSS score: 10.0/10. Published 2026-08-29.

How severe is CVE-2026-82456?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Vulnerability in Argoproj-Labs Argocd-Mcp

CVE-2026-82456

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Argoproj-labs Argocd-mcp

Weakness classification (CWE)

CWE-1327

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82456?: CVE-2026-82456 is a critical-severity vulnerability in Argoproj-Labs Argocd-Mcp, classified under CWE-1327. CVSS score: 10.0/10. Published 2026-08-29.
How severe is CVE-2026-82456?: Critical severity. CVSS v3 base score is 10.0 out of 10.