VULNERABILITY INTELLIGENCE
CVE-2026-82277
CVSS score9.8 CRITICAL
EPSS probability0.78%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
Weakness classification
- disclosure@vulncheck.com: CWE-306