Description

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T20:20:18.760Z",
  "pubdate": "2026-08-28T20:20:18.760Z",
  "executiveSummary": "The Argo Rollouts dashboard, in versions up to and including 1.10.0, is susceptible to an unauthenticated remote execution vulnerability resulting from a failure to implement proper access controls. The dashboard service binds to all network interfaces by default and exposes sensitive mutating API endpoints without requiring authentication, authorization, or cross-site request forgery (CSRF) protections. This configuration flaw allows any attacker with network connectivity to the dashboard to issue arbitrary control commands, including promoting, aborting, restarting, or rolling back deployments across all namespaces accessible to the controller's kubeconfig. The lack of security controls effectively delegates the operator's high-level Kubernetes permissions to any network participant. This represents a critical risk to the integrity and availability of the CI/CD pipeline and the deployed infrastructure. Exploitation requires no prior authentication and can be performed through standard HTTP requests, enabling unauthorized modification of workload states and potential disruption of service deployments within the affected Kubernetes cluster.",
  "technicalDetails": "The vulnerability originates from the architectural decision to expose the Argo Rollouts dashboard API endpoints without an integrated authentication or authorization layer. The service binds to 0.0.0.0, making it accessible to any entity with network path reachability to the pod or service. Because the application lacks a validation mechanism for incoming requests, it processes sensitive operations regardless of the requester's identity.\nThe affected components are the mutating operations exposed by the dashboard's API, specifically the following function calls: PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout. These functions interact directly with the Kubernetes API using the service account permissions assigned to the Argo Rollouts controller.\nThe attack flow is straightforward: 1) The attacker identifies the dashboard service on the network. 2) The attacker crafts an HTTP request targeting the specific API endpoint corresponding to the desired mutation. 3) Because the dashboard lacks CSRF protection, an attacker could also orchestrate this exploit via a browser-based attack, forcing a logged-in administrator to perform actions unknowingly. 4) The Argo Rollouts service receives the request, assumes the request is legitimate due to the lack of header verification, and executes the operation against the Kubernetes API.\nThe scope of impact is determined by the Role-Based Access Control (RBAC) configuration of the service account used by the Argo Rollouts controller. If the controller possesses cluster-admin or broad namespace-wide permissions, the attacker gains the ability to manipulate any rollout governed by the controller. This allows for unauthorized deployment modifications, image swapping, or the deliberate breaking of production environments through forced rollbacks and aborts.\nThe vulnerability exists across all versions up to and including 1.10.0. The lack of an authentication proxy or internal middleware to inspect session headers or tokens means the system fails to maintain the principle of least privilege or secure inter-process communication standards required for high-privilege CI/CD orchestration tools."
}