CVE-2026-82277— Argo Rollouts Dashboard Unauthenticated Mutating Operations
Quick assessment
Affected
argoproj argo-rollouts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
argoproj Argo Rollouts dashboard是argoproj组织的一个展示渐进式交付过程的可视化控制面板。 argoproj Argo Rollouts dashboard 1.10.0及之前版本存在授权问题漏洞，该漏洞源于仪表板绑定到所有接口且未对变更Rollout操作进行身份验证、授权或CSRF保护，同一网络的攻击者可跨操作员kubeconfig可访问的所有命名空间调用PromoteRollout、AbortRollout、RestartRollout、SetRolloutIma
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1210.004 T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| argoproj | argo-rollouts | ≤ 1.10.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82277
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Argo Rollouts Dashboard Unauthenticated Mutating Operations
Source: CVE Program / CVE List V5
Vulnerability Description
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
argoproj Argo Rollouts dashboard 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
argoproj Argo Rollouts dashboard是argoproj组织的一个展示渐进式交付过程的可视化控制面板。 argoproj Argo Rollouts dashboard 1.10.0及之前版本存在授权问题漏洞，该漏洞源于仪表板绑定到所有接口且未对变更Rollout操作进行身份验证、授权或CSRF保护，同一网络的攻击者可跨操作员kubeconfig可访问的所有命名空间调用PromoteRollout、AbortRollout、RestartRollout、SetRolloutIma
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| argoproj | argo-rollouts | 0 ~ 1.10.0 | - |
|
II. Public POCs for CVE-2026-82277
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82277
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82277 (2)
Vendor Pages for CVE-2026-82277 (1)
IV. Related Vulnerabilities
Same vendor: argoproj
-
CVE-2026-77459
Argo CD: AppProject destination-namespace and resource restr -
CVE-2026-55797
Argo CD repo-server command injection via crafted SSH reposi -
CVE-2026-93991
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosur -
CVE-2026-54526
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactG -
CVE-2026-45737
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideD
Same weakness: CWE-306
-
CVE-2026-16740
Missing Authentication for Critical Function in TR7 Cyber -
CVE-2026-103905
Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL -
CVE-2026-109969
Clevis: clevis: no authentication on pkcs#11 af_unix sockets -
CVE-2026-108473
Improper Authentication and Credential Exposure in Multiple -
CVE-2026-97793
Windows Setup and Deployment Elevation of Privilege Vulnerab
V. Comments for CVE-2026-82277
No comments yet