CVE-2026-82277CWE-306

CVE-2026-82277

Critical · published August 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00779 · 55.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-29T00:20Z
References (4)
https://github.com/argoproj/argo-rollouts · [email protected]https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go · [email protected]https://github.com/argoproj/argo-rollouts/issues/4747 · [email protected]https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Argo Rollouts Dashboard Unauthenticated Mutating Operations
    cvelistv5