CVE-2026-82277: Argo Rollouts Dashboard Auth Bypass Flaw

CVE-2026-82277 Overview

CVE-2026-82277 is a missing authentication vulnerability [CWE-306] in the Argo Rollouts dashboard through version 1.10.0. The dashboard binds to all network interfaces and exposes mutating Rollout operations without authentication, authorization, or Cross-Site Request Forgery (CSRF) protection. Any attacker with network access to the dashboard can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations. These operations execute across all namespaces reachable by the operator's kubeconfig, allowing tampering with production deployments in a Kubernetes cluster.

Critical Impact
Unauthenticated network attackers can manipulate Rollout resources across every namespace the Argo Rollouts operator can access, including forcing arbitrary container images into production workloads.

Affected Products

Argo Rollouts dashboard versions up to and including 1.10.0
Kubernetes clusters running the Argo Rollouts controller with the dashboard component enabled
Environments where the dashboard is reachable on the pod, node, or cluster network

Discovery Timeline

2026-08-28 - CVE-2026-82277 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in the NVD database

Technical Details for CVE-2026-82277

Vulnerability Analysis

The Argo Rollouts dashboard is a component of the argoproj Argo Rollouts project used to manage progressive delivery strategies such as canary and blue-green deployments on Kubernetes. The dashboard exposes gRPC and HTTP endpoints that wrap Kubernetes API operations against Rollout custom resources.

In versions through 1.10.0, the dashboard server binds to 0.0.0.0 and serves mutating operations with no authentication layer, no authorization checks, and no CSRF tokens. Any client that can reach the dashboard port can issue write operations. The dashboard executes those operations using the operator's kubeconfig, which typically has cluster-scoped or multi-namespace privileges over Rollout resources.

Exploitation lets an attacker change container images with SetRolloutImage, promote in-flight canaries with PromoteRollout, or roll workloads back with UndoRollout. This yields integrity and availability impact against production applications and provides a pivot for supply chain and lateral movement scenarios inside the cluster.

Root Cause

The root cause is missing authentication [CWE-306] on the dashboard's mutating endpoints, combined with an insecure default network binding. The server code initializes listeners on all interfaces without enforcing identity on inbound requests. See the Argo Rollouts server code and issue #4747 for the upstream discussion.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker with routable access to the dashboard port, whether from another pod, a workload on the node network, or a misconfigured LoadBalancer or NodePort service, can send crafted HTTP or gRPC requests to invoke mutating Rollout operations. Because CSRF protection is absent, a browser-based attack against an authenticated operator's session is also feasible when the dashboard is reachable from the victim's browser.

Refer to the VulnCheck advisory for technical exploitation details. No verified public proof-of-concept code is included here.

Detection Methods for CVE-2026-82277

Indicators of Compromise

Unexpected changes to Rollout resource spec.template.spec.containers[].image fields that do not correspond to a known CI/CD pipeline execution.
Kubernetes audit log entries showing patch or update verbs on rollouts.argoproj.io from the Argo Rollouts controller service account outside of scheduled deployment windows.
Unsolicited PromoteRollout, AbortRollout, or UndoRollout API calls recorded in dashboard access logs.
Inbound TCP connections to the dashboard service port from source addresses outside the expected operator or CI/CD network ranges.

Detection Strategies

Enable Kubernetes API server audit logging at the RequestResponse level for the argoproj.io API group and alert on mutating verbs.
Correlate Rollout resource changes with authenticated deployment pipeline events to surface out-of-band modifications.
Inspect NetworkPolicy coverage to identify Argo Rollouts dashboard pods that accept traffic from unrestricted sources.
Fingerprint the dashboard HTTP response signature during internal network scans to inventory exposed instances.

Monitoring Recommendations

Forward Kubernetes audit logs and Argo Rollouts dashboard access logs to a centralized SIEM or data lake for retention and correlation.
Alert on any external ingress reaching the dashboard service, especially through LoadBalancer, NodePort, or Ingress objects.
Baseline expected image registries and alert when a Rollout references an image outside the approved registry list.

How to Mitigate CVE-2026-82277

Immediate Actions Required

Restrict dashboard exposure by binding the service to localhost or an internal ClusterIP only, and remove any LoadBalancer or public Ingress fronting the dashboard.
Apply a Kubernetes NetworkPolicy that limits ingress to the Argo Rollouts dashboard pods to a small set of known operator sources.
Place the dashboard behind an authenticating reverse proxy that enforces identity, authorization, and CSRF protection.
Reduce the privileges of the Argo Rollouts controller kubeconfig to the minimum namespaces required.

Patch Information

At the time of publication, the Argo Rollouts repository tracks remediation discussion in issue #4747. Monitor the upstream project releases for a fixed version above 1.10.0 that introduces authentication, authorization, and CSRF protection on the dashboard, and upgrade as soon as a patched release is available.

Workarounds

Disable the dashboard component entirely and manage Rollouts through the kubectl argo rollouts CLI when interactive management is not required.
Access the dashboard exclusively through kubectl port-forward from operator workstations, avoiding cluster-wide network exposure.
Enforce authentication in front of the dashboard using an OAuth2 proxy or service mesh policy that requires mutual TLS and identity verification.
Segment Argo Rollouts controllers per environment so a compromised dashboard cannot alter unrelated production namespaces.

bash

# Configuration example: restrict dashboard exposure with a NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-rollouts-dashboard-restrict
  namespace: argo-rollouts
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: argo-rollouts
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: platform-operators
      ports:
        - protocol: TCP
          port: 3100