CVE-2026-82456: argocd-mcp Authentication Bypass Flaw

CVE-2026-82456 Overview

CVE-2026-82456 is an authentication bypass vulnerability in argocd-mcp version 0.8.0, the Model Context Protocol (MCP) server for Argo CD. The server binds its HTTP transport to every network interface (0.0.0.0) and accepts MCP sessions without validating caller credentials when ARGOCD_API_TOKEN is configured. Any attacker who can reach the listener can invoke the full MCP tool surface using the operator's stored Argo CD API token. This allows unauthenticated remote attackers to create applications, trigger syncs, and modify Argo CD resources through the exposed session. The flaw is tracked under CWE-1327: Binding to an Unrestricted IP Address.

Critical Impact
Unauthenticated network attackers can fully control Argo CD deployments, enabling malicious application creation, cluster resource modification, and pipeline compromise across GitOps-managed environments.

Affected Products

argocd-mcp version 0.8.0 (Model Context Protocol server for Argo CD)
Deployments using the HTTP transport with ARGOCD_API_TOKEN configured
Argo CD environments accessible through the exposed MCP listener

Discovery Timeline

2026-08-29 - CVE-2026-82456 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82456

Vulnerability Analysis

The argocd-mcp project exposes Argo CD operations as MCP tools intended for AI assistants and automation workflows. Version 0.8.0 starts its HTTP transport listener bound to all network interfaces rather than loopback. The server does not enforce any authentication on incoming MCP session requests. Instead, it forwards every request to the upstream Argo CD API using the operator-supplied ARGOCD_API_TOKEN stored in the process environment. This design conflates the operator identity with the caller identity. Any client that can open a TCP connection to the listening port inherits the full privileges of the configured Argo CD token.

Root Cause

The root cause is a missing authentication boundary between the MCP transport and the Argo CD backend. The server assumes the transport is trusted, so it does not validate session initialization, bearer tokens, or client identity. Combined with the default bind address covering every interface, this exposes a privileged proxy to the network.

Attack Vector

An attacker with network reachability to the MCP port sends a standard MCP initialize request followed by tool invocations such as application creation or sync operations. The server relays each call to Argo CD authenticated with the stored token. No credentials, headers, or client certificates are required from the caller. Refer to the VulnCheck advisory for argocd-mcp and GitHub Security Advisory GHSA-rp45-5x3v-48mr for protocol-level details.

Detection Methods for CVE-2026-82456

Indicators of Compromise

Unexpected Argo CD Application resources, sync operations, or repository registrations attributed to the service account tied to ARGOCD_API_TOKEN.
Inbound TCP connections to the argocd-mcp listener port from non-loopback and non-allowlisted sources.
MCP tools/call requests originating from external IP ranges in server logs.
Argo CD audit entries showing bulk application creation or destructive sync operations outside normal change windows.

Detection Strategies

Inventory hosts running argocd-mcp 0.8.0 and confirm whether the HTTP transport binds to 0.0.0.0 or a public interface.
Correlate Argo CD API audit logs with MCP server access logs to identify actions not tied to a legitimate operator session.
Alert on Argo CD API activity from the MCP token that originates outside expected automation windows or source IPs.

Monitoring Recommendations

Forward Argo CD server audit logs and argocd-mcp process logs to a centralized analytics pipeline for correlation.
Monitor network flow data for connections to the MCP listener port from unauthorized subnets.
Track creation, mutation, and deletion of Argo CD Application, AppProject, and Repository objects and alert on anomalies.

How to Mitigate CVE-2026-82456

Immediate Actions Required

Take the argocd-mcp 0.8.0 HTTP listener offline until a patched release is deployed or network controls are enforced.
Rotate the ARGOCD_API_TOKEN used by the MCP server and any Argo CD credentials that may have been exercised through the exposed listener.
Review Argo CD audit logs and Git repository history for unauthorized applications, sync operations, or manifest changes.

Patch Information

At time of publication, remediation guidance is coordinated through the upstream project. Track fixes and updated release notes in the mcp-for-argocd repository and the GHSA-rp45-5x3v-48mr advisory. Upgrade to a fixed release once available and redeploy with rotated tokens.

Workarounds

Bind the MCP HTTP transport to 127.0.0.1 and reach it only through an authenticated reverse proxy or SSH tunnel.
Restrict access to the MCP listener with host firewalls, Kubernetes NetworkPolicy, or cloud security groups that allow only trusted client addresses.
Scope the ARGOCD_API_TOKEN to the minimum project and resource permissions required, avoiding cluster-wide administrative rights.
Prefer the stdio transport over HTTP when the MCP server is invoked by a local AI client, eliminating network exposure.

bash

# Configuration example: restrict argocd-mcp to loopback and enforce firewall rules
export MCP_HTTP_HOST=127.0.0.1
export MCP_HTTP_PORT=8080

# Host firewall example (Linux nftables) - drop external access to the MCP port
sudo nft add rule inet filter input tcp dport 8080 iif != "lo" drop

# Kubernetes NetworkPolicy snippet restricting ingress to the MCP pod
# apiVersion: networking.k8s.io/v1
# kind: NetworkPolicy
# metadata:
#   name: argocd-mcp-restrict
# spec:
#   podSelector:
#     matchLabels:
#       app: argocd-mcp
#   ingress:
#   - from:
#     - podSelector:
#         matchLabels:
#           role: mcp-client