Critical Vulnerability in argocd-mcp 0.8.0 Allows Unauthenticated Access

Executive Summary

A critical vulnerability (CVE-2026-82456) with a CVSS score of 10 has been discovered in argocd-mcp 0.8.0. This vulnerability allows unauthenticated attackers to access the tool's full surface using the operator's stored token, potentially leading to the creation of applications, request syncs, and modification of Argo CD resources. The vulnerability is considered critical, and immediate action is required to mitigate it.

Technical Analysis

The vulnerability is classified as an authentication bypass issue. The argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when the ARGOCD_API_TOKEN is configured. This allows attackers who can reach the listener to invoke the full tool surface using the operator's stored token. The root cause of this vulnerability is the lack of proper authentication and authorization mechanisms.

How It Gets Exploited

An unauthenticated remote attacker who can reach the listener can exploit this vulnerability by sending an HTTP request to the argocd-mcp service. Since the service accepts MCP sessions without requiring caller credentials, the attacker can use the operator's stored token to create applications, request syncs, and modify Argo CD resources. For example, an attacker could send a crafted request to the /api endpoint to create a new application or modify an existing one.

Impact Assessment

The impact of this vulnerability is critical, with a CVSS score of 10. The vulnerability affects argocd-mcp version 0.8.0 and is fixed in version 0.9.0. An attacker who exploits this vulnerability can achieve arbitrary actions on the Argo CD resources, including creating applications, requesting syncs, and modifying resources. The blast radius of this vulnerability is high, as it allows unauthenticated access to the tool's full surface.

Recommended Actions

To mitigate this vulnerability, it is recommended to update argocd-mcp to version 0.9.0 or later. Additionally, users should ensure that the ARGOCD_API_TOKEN is not exposed to unauthorized parties and that the service is not accessible from untrusted networks. Implementing proper authentication and authorization mechanisms, such as network segmentation or access controls, can also help prevent exploitation.