CVE-2026-82277

CVSS 9.8 (critical) · published 2026-08-28

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Weakness: CWE-306

Source: NVD CVE-2026-82277

References

• https://github.com/argoproj/argo-rollouts
• https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go
• https://github.com/argoproj/argo-rollouts/issues/4747
• https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.