A critical missing-authentication flaw in the Argo Rollouts dashboard through version 1.10.0 lets any unauthenticated attacker who can reach the dashboard over the network drive mutating Rollout operations across every namespace the operator's kubeconfig can reach.
What Is It
The Argo Rollouts dashboard binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Tracked as CWE-306 (Missing Authentication for Critical Function), it carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). The record was published 2026-08-28 by VulnCheck and is currently in "Received" status at NVD.
Why It Matters
Exploitation requires network access and nothing else; no privileges, no user interaction, low attack complexity. The attack vector is rated Network (AV:N), so the attacker does not need to be adjacent to the victim; any host with a route to the listening dashboard qualifies. Confidentiality, integrity, and availability impacts are all rated HIGH. An attacker who can reach the dashboard can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout. The SetRolloutImage operation is the sharpest edge here: it lets an unauthenticated caller dictate the container image a rollout deploys. Because the dashboard acts with the operator's kubeconfig, the blast radius covers all namespaces that credential can reach, not just the one an attacker might already have a foothold in.
The absence of CSRF protection widens this further; a dashboard operator merely browsing a hostile page could have these state-changing calls issued on their behalf.
What's Vulnerable
- Vendor: argoproj
- Product: argo-rollouts
- Affected versions: all versions from 0 through 1.10.0 (semver, inclusive)
No CPE entries are listed in the NVD record at this time.
Patch Status
Neither the NVD record nor the VulnCheck advisory lists a fixed version, patch, or vendor remediation guidance as of publication. We have seen no indication that CVE-2026-82277 has been added to the CISA Known Exploited Vulnerabilities catalog, but defenders should confirm current KEV status directly against the catalog rather than relying on this brief, and should not read the absence of a listing as evidence that exploitation is not occurring. Defenders should track the upstream GitHub issue (argoproj/argo-rollouts#4747) and the VulnCheck advisory for fix availability, and in the interim treat dashboard network reachability as the primary exposure to control.
Sources
- NVD, CVE-2026-82277: https://nvd.nist.gov/vuln/detail/CVE-2026-82277
- VulnCheck Advisory; Argo Rollouts Dashboard Unauthenticated Mutating Operations: https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations
- GitHub Issue; argoproj/argo-rollouts#4747: https://github.com/argoproj/argo-rollouts/issues/4747
- GitHub; argoproj/argo-rollouts
server/server.go: https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go - GitHub; argoproj/argo-rollouts: https://github.com/argoproj/argo-rollouts