Description

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-29T14:16:38.767Z",
  "pubdate": "2026-08-29T14:16:38.767Z",
  "executiveSummary": "A critical security vulnerability exists in argocd-mcp version 0.8.0 involving improper access control and insecure network binding. The application exposes its Model Context Protocol (MCP) server on all network interfaces without enforcing authentication, despite the presence of a configured ARGOCD_API_TOKEN. This configuration flaw allows any network-adjacent attacker to interact with the service and execute arbitrary operations using the privileges of the stored API token. By invoking the full tool surface, unauthorized parties can manipulate Argo CD resources, trigger application synchronizations, and create new application definitions. The lack of credential validation for incoming MCP sessions effectively grants an attacker the same administrative capabilities as the legitimate service operator. The vulnerability poses a significant risk to internal Argo CD environments, as it circumvents established security boundaries, potentially leading to unauthorized deployments, data manipulation, or persistence within the Kubernetes cluster. Exploitation requires no specific credentials, relying solely on network connectivity to the vulnerable listener.",
  "technicalDetails": "The root cause of this vulnerability lies in the combination of permissive network interface binding and a failure to perform session-level authentication within the MCP transport layer of argocd-mcp 0.8.0. By default, the service binds to all available network interfaces (0.0.0.0), exposing the MCP endpoint beyond the local host. Although the application is designed to utilize an ARGOCD_API_TOKEN for its backend operations, the implementation fails to gate access to the MCP interface with this or any other form of authentication.\nThe exploitation flow initiates with the attacker establishing a connection to the argocd-mcp listener over the network. Once the transport layer connection is established, the attacker initiates an MCP session. Because the service does not validate the identity of the caller, the session is established successfully without the requirement of a client-side secret or token. After the session is initialized, the attacker can leverage the pre-configured ARGOCD_API_TOKEN—which is held in the application's memory or configuration environment—to perform authenticated requests against the Argo CD API server.\nThe payload behavior involves the attacker submitting requests to the MCP tool surface that correspond to privileged Argo CD actions. Since the service executes these requests using the static ARGOCD_API_TOKEN, the Argo CD API server treats the traffic as legitimate, authorized activity from the operator. An attacker can systematically invoke functions to create new applications, modify existing deployment manifests, or trigger sync operations. This effectively provides a command-and-control conduit into the Argo CD environment.\nThe impact of this vulnerability is severe because it facilitates unauthorized management of the continuous delivery pipeline. Post-exploitation, an attacker can modify Kubernetes resource manifests, leading to the deployment of malicious workloads, modification of existing service configurations, or disruption of production services. The privilege level of the attacker is equivalent to the permissions assigned to the ARGOCD_API_TOKEN, which are typically elevated in standard production deployments. The lack of authentication acts as a bypass to the Principle of Least Privilege, as there is no verification mechanism to distinguish between authorized tools and malicious external actors."
}