CVE-2026-82456: Argo CD's MCP server took sessions from anyone who could reach it, scored a flat 10.0; the fix beat the record by 18 days

VulnCheck published CVE-2026-82456 on 2026-08-29 against argocd-mcp, the MCP server for Argo CD maintained in the Argo Project's argoproj-labs organization. In version 0.8.0, the HTTP transport bound to every network interface and accepted MCP sessions without requiring caller credentials whenever an ARGOCD_API_TOKEN was configured. Any peer who could reach the listener inherited the operator's stored token and the full tool surface: creating applications, requesting syncs, reading cluster resources, whatever the token allowed in Argo CD itself. The record scores it 10.0 on both CVSS 4.0 and 3.1.

The disclosure followed the pattern that now dominates this feed's security coverage: the fix came first, the record later. v0.9.0 shipped on 2026-08-11, the repository advisory (GHSA-rp45-5x3v-48mr, critical) went out the same day, and the CVE record arrived 18 days after both. Only 0.8.0, released 2026-06-11, is affected.

A deployment-tool MCP server is a high-consequence place for a missing authentication check. Argo CD instances hold credentials to the clusters they deploy to, so an exposed argocd-mcp listener was not a data-read problem but a path to cluster mutation with the operator's identity. Deployments still on 0.8.0 have had a fixed version available since August 11.