Threat database

2 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.3%	CVE-2026-108585argocd-mcp · Path Traversal Medium5.3EPSS 0.3%2026-10-10CVE Database V5CVE-2026-108585 argocd-mcp versions up to 0.9.0 contain a path traversal vulnerability in the delete_application tool. This flaw allows authenticated MCP clients to manipulate the applicationName parameter with dot-segment values to access unintended API endpoints. Exploitation can lead to deletion of repositories, clusters, or projects within the scope of the token's RBAC permissions. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. EPSS 0.3%Vulnerability argoproj-labs #ghsa-f7cg-qc77-hh95	CVE Database V5	2026-10-10
Critical	10.0	EPSS 1.7%	CVE-2026-82456argocd-mcp · Binding to an Unrestricted IP Address Critical10.0EPSS 1.7%2026-08-29CVE Database V5CVE-2026-82456 argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources. EPSS 1.7%Vulnerability argoproj-labs #ghsa-p2x5-x87w-v2xj	CVE Database V5	2026-08-29

Showing 1–2 of 2 results