CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
Attackers can bypass authentication to modify Argo CD resources using the operator's token if the server is exposed and configured with an API token.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82456?
CVE-2026-82456 is a critical authentication bypass vulnerability in argoproj-labs argocd-mcp, published on 29 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
Weakness: CWE-1327
Which versions are affected by CVE-2026-82456?
How do I fix CVE-2026-82456?
No fix has been published for CVE-2026-82456 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-82456 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82456 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-p2x5-x87w-v2xj, GHSA-rp45-5x3v-48mr.