CyberRota Analysis
AI-GeneratedArgo CD versions prior to 0.8.0 are critically vulnerable due to an HTTP transport binding that accepts uncredentialed MCP sessions when the ARGOCD_API_TOKEN is configured. This flaw allows attackers with network access to exploit the operator's stored token, enabling them to create applications, initiate syncs, and alter Argo CD resources. Organizations using Argo CD should prioritize immediate remediation to mitigate the risk of unauthorized access and potential resource manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.