CVE-2026-82456Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1327

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 3d ago at 3 mentions (2026-08-30); latest day: 1
7 total mentions across 5 days

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

Disclosure

457.1%

General

228.6%

Patch

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-29	1	Disclosure1
2026-08-30	3	Disclosure1General2
2026-09-01	1	Disclosure1
2026-09-11	1	Disclosure1
2026-09-18	1	Patch1

Full discourse7 posts

Upwind Security MDR@UpwindMDR47d
Disclosure
🚨Critical - argocd-mcp Unauthenticated MCP Session Hijack via Exposed HTTP Listener (CVE-2026-82456) argocd-mcp 0.8.0 binds its HTTP transport to 0.0.0.0 and, when ARGOCD_API_TOKEN is set, accepts MCP sessions without caller auth. Any network-reachable attacker can ride the operator’s stored token to create apps, trigger sync, and modify Argo CD resources. 👉Upgrade to 0.9.0
Post summary
CVE-2026-82456 describes an unauthenticated session hijack in argocd-mcp 0.8.0, recommending an upgrade to 0.9.0.
30020172
310 followersView on X
pdnuclei-bot@pdnuclei_bot27d
Patch
🚨 CVE-2026-82456 - critical 🚨 argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access > argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiri... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-82456 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet discloses CVE-2026-82456 affecting argocd-mcp versions before 0.9.0, highlighting an unauthenticated MCP session and tool access vulnerability, and indicates that version 0.9.0 resolves the issue.
00022405
1.4K followersView on X
NewNormal Security@NewScanTeam46d
General
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 30 Aug 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🔓 MCP server that authenticates no caller — drive every tool the agent exposes, anonymously (argocd-mcp CVE-2026-82456) 🔑 JWT accepted without checking its signature — forge a token for any user (Omnivore CVE-2026-82454) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🔀 SSRF allow-list that forgets carrier-grade NAT — reach the cloud metadata service the guard was written to block (Memos CVE-2026-82476) 📦 WordPress SSO plugin with an authentication bypass — sign in as any account, no password (miniOrange SAML Single Sign On CVE-2026-75807) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #SSRF #CSO #REDTEAM
Post summary
The post lists newly covered CVEs with brief technical descriptions, but offers no PoC, exploit code, or patch information.
1001084
7 followersView on X
Kaitan ID Security@KaitanSecurity34d
Disclosure
🛡️ ArgoCD MCP and MapLibre: Open-Source CI/CD and Mapping Under Threat CVE-2026-82456 in argocd-mcp 0.8.0 is a textbook misconfiguration turned critical: the HTTP transport binds to every network interface and accepts MCP sessions without requiring…
Post summary
CVE‑2026‑82456 in argocd‑mcp 0.8.0 is a critical misconfiguration: the HTTP transport listens on all interfaces and accepts MCP sessions without authentication, exposing the system to potential exploitation.
1000048
88 followersView on X
SecAlerts@SecAlertsCo44d
Disclosure
🚢 ArgoCD MCP server exposes every interface with zero auth. CVE-2026-82456 in argocd-mcp 0.8.0 lets anyone reach your MCP sessions when ARGOCD_API_TOKEN is set. CVSS 10. Check your deployments now. #cybersecurity #ciso #vulnerabilities #gitops https://secalerts.co/vulnerability/CVE-2026-82456?utm_campaign=x https://t.co/apHrNc0nsW
Post summary
The tweet announces a critical CVE in ArgoCD MCP v0.8.0, noting zero authentication and a CVSS score of 10, but it does not provide any exploit code or mitigation details.
0000075
885 followersView on X
ThreatAft@ThreatAft46d
Disclosure
🔐 🚨 argocd-mcp — CVSS 10.0 CRITICAL CVE-2026-82456: Unauthenticated full ArgoCD takeover → https://threataft.com/articles/argocd-mcp-cve-2026-82456-unauthenticated-takeover #cybersecurity #infosec #ArgoCD #Kubernetes #GitOps #CVSS10 #SupplyChain #ThreatIntel
Post summary
CVE-2026-82456 is a newly disclosed critical vulnerability that permits unauthenticated takeover of ArgoCD, and it is discussed in an online article linked in the tweet.
0000059
37 followersView on X
ADK Cyber@ADKCyber46d
General
CVE-2026-82456 (CVSS 10.0): argocd-mcp 0.8.0 binds HTTP to all interfaces without credentials when ARGOCD_API_TOKEN is set. Review exposure if deployed. https://nvd.nist.gov/vuln/detail/CVE-20… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/Stvop3m3to
Post summary
The tweet announces CVE‑2026‑82456 with a CVSS 10.0 score and a brief technical description, but does not provide PoC, exploit code, or patch information.
0000045
95 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-82456

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-82456 describes an unauthenticated session hijack in argocd-mcp 0.8.0, recommending an upgrade to 0.9.0.

NewNormal Security[verified]@NewScanTeamGeneral

The post lists newly covered CVEs with brief technical descriptions, but offers no PoC, exploit code, or patch information.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

CVE‑2026‑82456 in argocd‑mcp 0.8.0 is a critical misconfiguration: the HTTP transport listens on all interfaces and accepts MCP sessions without authentication, exposing the system to potential exploitation.

ADK Cyber[verified]@ADKCyberGeneral

The tweet announces CVE‑2026‑82456 with a CVSS 10.0 score and a brief technical description, but does not provide PoC, exploit code, or patch information.

pdnuclei-bot@pdnuclei_botPatch

The tweet discloses CVE-2026-82456 affecting argocd-mcp versions before 0.9.0, highlighting an unauthenticated MCP session and tool access vulnerability, and indicates that version 0.9.0 resolves the issue.

SecAlerts@SecAlertsCoDisclosure

The tweet announces a critical CVE in ArgoCD MCP v0.8.0, noting zero authentication and a CVSS score of 10, but it does not provide any exploit code or mitigation details.

ThreatAft@ThreatAftDisclosure

CVE-2026-82456 is a newly disclosed critical vulnerability that permits unauthenticated takeover of ArgoCD, and it is discussed in an online article linked in the tweet.