Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-108585

argocd-mcp through 0.9.0 Path Traversal via delete_application Tool

argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Argoproj-labs
Products
Argocd-mcp
CVE-2026-82456

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed
Vendors
Argoproj-labs
Products
Argocd-mcp