CVE-2026-82277: Missing Authentication for Critical Function in argoproj argo-rollouts

CVE-2026-82277 describes a missing authentication vulnerability in Argo Rollouts dashboard versions up to 1.10.0. The dashboard binds to all interfaces and exposes critical mutating operations without requiring authentication, authorization, or CSRF protection. This enables attackers on the same network segment to invoke operations like PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout across all namespaces accessible to the operator's kubeconfig, potentially leading to unauthorized modification of rollout states.

An unauthenticated attacker on the same network can perform critical mutating operations on Argo Rollouts deployments, potentially disrupting or manipulating deployment rollouts across all namespaces accessible to the operator's kubeconfig. This can lead to unauthorized changes in application deployment states, causing service disruption or unauthorized code deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Argo Rollouts dashboard to trusted users only and consider network segmentation to prevent unauthorized access from untrusted networks.