CVE-2026-82277

The Argo Rollouts dashboard (all versions through 1.10.0) binds to all network interfaces and exposes state-changing Rollout operations over its API with no authentication, authorization, or CSRF protection (CWE-306, missing authentication for a critical function). Exploitation requires only network reachability to the dashboard port: another workload in the cluster, a host on the same network, or an unauthenticated remote client where the dashboard is published via NodePort, LoadBalancer, or Ingress can issue API calls directly, with no credentials or user interaction required. An attacker can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout across every namespace accessible to the operator's kubeconfig, letting them change deployed images (potentially to a malicious one), force or undo promotions, and restart or retry rollouts. Any organization running the affected dashboard without network restrictions is exposed, though the practical blast radius is capped by the RBAC permissions of the Rollouts operator's kubeconfig. No public proof-of-concept or in-the-wild exploitation is known, and near-term exploitation risk appears low (EPSS 0.4%, not in CISA KEV).

What to do: Do not expose the dashboard on all interfaces or publish it via NodePort, LoadBalancer, or Ingress without an authenticating proxy; restrict access with firewall rules or NetworkPolicies, and run the dashboard only on localhost when used locally. Upgrade Argo Rollouts to a release newer than 1.10.0 once a patched version is published (check the vendor advisory for the fixed version). Review recent rollout and image history in accessible namespaces for unexpected SetRolloutImage, promote, undo, or restart operations.