CVE-2026-82456

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and, when ARGOCD_API_TOKEN is configured, accepts MCP sessions without authenticating the caller. Any attacker who can reach the listener can open a session and invoke the server's full tool surface, which executes with the operator's stored Argo CD token. This grants the attacker the ability to create applications, request syncs, and modify Argo CD resources, effectively handing network-reachable clients the operator's write access to the GitOps controller. Operators running argocd-mcp 0.8.0 with the HTTP transport enabled and the listener reachable beyond localhost are affected. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and EPSS estimates about a 0.4% probability of exploitation within 30 days.

What to do: Audit whether argocd-mcp 0.8.0 is deployed and whether its HTTP transport is bound beyond localhost; if so, restrict it to localhost or an allowlisted network path using firewall rules or an authenticating reverse proxy. Consider removing or scoping ARGOCD_API_TOKEN to minimal RBAC permissions until a patched release is available, and monitor the project for a fix.