CVE-2026-82277

9.3 criticalEPSS 0.8%

Critical (9.3). EPSS 0.8% chance of exploitation in the next 30 days.

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-08-28
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/argoproj/argo-rollouts
https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go
https://github.com/argoproj/argo-rollouts/issues/4747
https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations

Check your stack JSON