CVE-2026-82277
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| argoproj | argo-rollouts | 0 <= 1.10.0 | affected |
Weaknesses
- CWE-306: Missing Authentication for Critical Function
References
- https://github.com/argoproj/argo-rollouts/issues/4747
- https://github.com/argoproj/argo-rollouts
- https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go
- https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.