← News
/DISPATCH · 2026-08-31

argocd-mcp CVSS 10.0 Unauthenticated Takeover: Kubernetes GitOps Pipeline Becomes an Open Controller

argocd-mcp 0.8.0 binds the MCP listener to 0.0.0.0 and skips caller credential checks when ARGOCD_API_TOKEN is set. CVSS 10.0. Any attacker who can reach the listen port fully controls the Argo CD instance and deploys arbitrary manifests.

On 29 August 2026, argoproj-labs/mcp-for-argocd disclosed auth bypass CVE-2026-82456. CVSS 10.0. Affects the entire argocd-mcp 0.8.0 line. 0.9.0 is the fix. argocd-mcp is the Model Context Protocol server from the official Argo CD experimental repo, bridging AI agents to GitOps infrastructure. Trigger: if `ARGOCD_API_TOKEN` is set, the MCP service binds the HTTP transport to all interfaces (`0.0.0.0`) and skips caller credential checks, admitting MCP sessions.

Attack Path

Any network entity that can reach the argocd-mcp listen port reuses the operator-configured `ARGOCD_API_TOKEN` and fully invokes the MCP toolset: create Application objects, trigger sync, mutate deploy resources, read Secrets. Under GitOps, a compromised MCP server pulls attacker-controlled Git repo manifests and syncs them into production Kubernetes—handing the entire deploy pipeline to an unauthorized remote. CVSS 4.0 vector `AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`. Scope Changed: impact is not just the argocd-mcp process but the connected Argo CD instance and the workloads it deploys.

Typical Deployment

In GitOps practice, argocd-mcp usually runs as a Sidecar or standalone Deployment in the same namespace as Argo CD, exposed via a local Service to AI Agent orchestration. `ARGOCD_API_TOKEN` is typically written by CI/CD into a ConfigMap at deploy time; privileges often equal project admin. Cursor, Claude Code, Codex CLI then use the MCP to auto-create/sync Applications, read deploy status, debug Helm templates. Once an attacker has network reachability to the argocd-mcp port, they reuse that existing high-privilege token and fully invoke the MCP toolset—without needing the token plaintext. MCP JSON-RPC has no built-in auth by default; SSO must be added at transport or gateway. Even if MCP listens on localhost, a misconfigured reverse proxy or Service Mesh can leak the port to the internet. End-to-end verify. If the port is wrongly exposed, any same-VPC node or internet scanner finds and exploits this 0day immediately.

Impact Assessment

Pre-fix there is no auth at all—purely network isolation and bind control. Internal AI Agent platforms commonly share a segment or ingress control plane with CI/CD jump hosts, so the actual exposure of the argocd-mcp listen port is far higher than expected. In multi-tenant Kubernetes, one team's argocd-mcp process becomes a pivot from the dev network into the production control plane, bypassing NetworkPolicy, PodSecurityAdmission, and Git review.

Fix and Mitigation

Upgrade to argocd-mcp 0.9.0. New version enforces caller identity and session checks.

If you cannot upgrade immediately:

Detection: anomalous argocd-mcp listen address; MCP JSON-RPC from unexpected segments; sudden Application create/sync in Argo CD audit logs; `source` fields pointing at unfamiliar Git repos.

References