CVE-2026-82456

CVE-2026-82456 in argocd-mcp 0.8.0 allows unauthenticated access to the operator's stored token when ARGOCD_API_TOKEN is configured, enabling attackers to modify Argo CD resources.

The vulnerability stems from the application binding its HTTP transport to every network interface and accepting MCP sessions without requiring caller credentials when a specific token is configured. This allows attackers who can reach the listener to invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources. DIB organizations should care because this represents a critical exposure of privileged credentials and control plane resources, directly impacting compliance with NIST 800-171 requirements for access control and system integrity. Organizations must ensure proper network segmentation, restrict listener bindings, and enforce strict credential validation for all API tokens.

Shame score — The failure to require caller credentials when a privileged token is configured, combined with binding to all network interfaces, represents a negligent design flaw that exposes critical control plane resources to unauthenticated attackers.