CVE-2026-82277

Received Received - Intake

Argo Rollouts Dashboard Unauthenticated API Access Vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82277

EUVD

EUVD-2026-67808

Affected Vendors & Products

Vendor	Product	Version / Range
argo	rollouts	1.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Argo Rollouts dashboard up to version 1.10.0 allows unauthenticated attackers on the same network to execute mutating operations like PromoteRollout, AbortRollout, and SetRolloutImage without authentication, authorization, or CSRF protection. The dashboard binds to all interfaces, exposing sensitive Kubernetes rollout management functions.

Detection Guidance

Check if the Argo Rollouts dashboard is exposed on all network interfaces by running: netstat -tulnp | grep argo-rollouts or ss -tulnp | grep argo-rollouts. Verify if the dashboard port (default 8080) is open and accessible without authentication.

Impact Analysis

An attacker could manipulate Kubernetes rollouts, potentially causing unauthorized deployments, rollbacks, or image changes across all namespaces accessible to the operator's kubeconfig. This could lead to service disruption, data corruption, or unauthorized access to sensitive systems.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access and modifications to systems handling sensitive data. It may breach confidentiality, integrity, and availability controls required by GDPR, HIPAA, and other regulations due to the lack of authentication and authorization.

Mitigation Strategies

Immediately restrict dashboard access by binding it to localhost only. Update Argo Rollouts to the latest version that patches this vulnerability. Implement network policies to block unauthorized access to the dashboard port.

Hi! I’m here to help you understand CVE-2026-82277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70