Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82277Argo Rollouts Dashboard Unauthenticated Mutating Operations

Critical 9.8

In plain English

A critical-severity missing authentication in argo-rollouts from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Affected products (as reported)

Vendor	Product	Versions
argoproj	argo-rollouts	0 – through 1.10.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #4747 issue-tracking
https://github.com/argoproj/argo-rollouts product
Vulnerable code: server.go technical-description
VulnCheck Advisory: Argo Rollouts Dashboard Unauthenticated Mutating Operations third-party-advisory