CVE-2026-108585: Argo CD MCP Server Path Traversal Flaw

CVE-2026-108585 Overview

CVE-2026-108585 is a path traversal vulnerability in argocd-mcp (Argo CD Model Context Protocol Server) through version 0.9.0. The delete_application tool fails to validate the applicationName parameter before concatenating it into an API path. MCP clients, or large language models manipulated through prompt injection, can supply dot-segment sequences such as ../repositories/ to redirect authenticated DELETE requests to unintended Argo CD endpoints. An attacker can delete repositories, clusters, or projects reachable by the server token's RBAC permissions.

Critical Impact
Prompt-injected AI agents or malicious MCP clients can abuse the vulnerable tool to issue authenticated DELETE requests against arbitrary Argo CD API routes within the token's scope.

Affected Products

argocd-mcp (Argo CD MCP Server) versions up to and including 0.9.0
Argo CD environments integrating the MCP server with LLM-driven clients
Deployments where the MCP server token holds RBAC permissions over repositories, clusters, or projects

Discovery Timeline

2026-10-10 - CVE-2026-108585 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108585

Vulnerability Analysis

The argocd-mcp server exposes a delete_application tool that accepts an applicationName parameter from the connected MCP client. The server embeds this value directly into the Argo CD REST API path used for the DELETE request. Because the parameter is not sanitized against path traversal patterns, a client can submit values containing ../ dot-segments to escape the /applications/ route and reach other administrative endpoints.

The HTTP client then forwards an authenticated DELETE request to the smuggled path. Successful exploitation permits deletion of repositories, clusters, or projects without invoking the dedicated Argo CD authorization checks associated with those resources. The impact is bounded by the RBAC permissions assigned to the MCP server's API token, but typical deployments grant broad application-management scopes. See the VulnCheck ArgoCD Path Traversal Advisory for additional context.

Root Cause

The root cause is improper input validation [CWE-22] in the delete_application handler. The vulnerable code paths referenced in the advisory are located in client.ts and http.ts. Neither location rejects dot-segments or normalizes the final request path before dispatch.

Attack Vector

An authenticated MCP client, or a model instructed through indirect prompt injection, calls the delete_application tool with a crafted applicationName such as ../repositories/https%3A%2F%2Fgit.example.com%2Frepo.git. The server resolves the traversal, issues an authenticated DELETE to the targeted Argo CD endpoint, and removes the resource. The HackMD write-up documents the route-smuggling technique in detail.

Detection Methods for CVE-2026-108585

Indicators of Compromise

Argo CD API audit logs showing DELETE requests to /api/v1/repositories/, /api/v1/clusters/, or /api/v1/projects/ originating from the MCP server's service account.
MCP tool invocation logs containing applicationName values with ../, %2e%2e%2f, or encoded dot-segment variants.
Unexpected deletion events for repositories, clusters, or projects correlated with LLM session activity.

Detection Strategies

Parse MCP server request logs for delete_application calls where the applicationName field fails strict allow-list validation (alphanumeric, hyphen, underscore).
Alert on any Argo CD administrative DELETE action attributed to the MCP token outside expected application scopes.
Correlate prompt-injection indicators in upstream LLM conversation logs with downstream Argo CD state changes.

Monitoring Recommendations

Enable verbose audit logging on the Argo CD API server and forward events to a centralized analytics platform.
Track baseline rates of resource deletions per service account and alert on deviations.
Monitor MCP tool invocation volume and parameter entropy to surface anomalous client behavior.

How to Mitigate CVE-2026-108585

Immediate Actions Required

Restrict the Argo CD API token used by argocd-mcp to the minimum RBAC scope required, excluding repository, cluster, and project deletion rights where feasible.
Disable the delete_application tool in MCP client configurations until a fixed release is deployed.
Isolate the MCP server from untrusted LLM contexts that process external or user-supplied content vulnerable to prompt injection.

Patch Information

At the time of NVD publication, the advisory identifies argocd-mcp versions through 0.9.0 as vulnerable. Track the mcp-for-argocd repository for a patched release and apply it as soon as it becomes available.

Workarounds

Deploy a reverse proxy in front of the Argo CD API that rejects paths containing dot-segments or encoded traversal sequences.
Implement an input validation wrapper around the delete_application tool that enforces a strict regex such as ^[a-zA-Z0-9._-]+$ on applicationName.
Rotate the MCP server token and audit historical Argo CD deletions attributed to it for signs of prior abuse.

bash

# Example reverse proxy rule rejecting path traversal attempts
location /api/v1/applications/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2E%2E%2F)") {
        return 400;
    }
    proxy_pass https://argocd-server.internal;
}