CVE-2026-108585 argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
Attackers can exploit path traversal in the delete_application tool to delete repositories, clusters, or projects via unvalidated input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108585?
CVE-2026-108585 is a medium-severity path traversal vulnerability in argoproj-labs argocd-mcp, published on 10 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.
Weakness: CWE-22
Which versions are affected by CVE-2026-108585?
How do I fix CVE-2026-108585?
No fix has been published for CVE-2026-108585 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-108585 being exploited?
There is no known exploitation of CVE-2026-108585 in the wild and no public exploit code.
Sources
Also known as GHSA-f7cg-qc77-hh95.