What happened
NVD published this critical (CVSS 4.0 = 10.0) vulnerability on Aug 29, 2026: an MCP server that bridges AI agents/automation to Argo CD's GitOps control plane exposes its tool surface with zero inbound authentication whenever an outbound Argo CD API token is configured, letting any network-reachable actor fully command Argo CD through the agent's own privileged credentials.
Why it matters
This is a textbook agent-authority confusion bug: an MCP server designed to let AI agents drive CI/CD conflates 'the agent is allowed to act' with 'anyone who can reach the agent is allowed to act.' Any organization exposing this MCP server to a shared network or CI runner grants full GitOps takeover — attacker-controlled manifests can be synced straight into production clusters.
Attack vector
argocd-mcp 0.8.0 binds its HTTP transport to 0.0.0.0 (all interfaces) and, when ARGOCD_API_TOKEN is configured, accepts MCP sessions from any network-reachable caller without validating caller credentials. An unauthenticated attacker who can reach the listener inherits the operator's stored Argo CD token and can invoke the full MCP tool surface — create applications, request syncs, and modify Argo CD resources.
Affected systems
argocd-mcp (argoproj-labs/mcp-for-argocd) == 0.8.0
Mitigation
Upgrade to argocd-mcp 0.9.0+. Bind the HTTP listener to loopback (127.0.0.1) by default, place an authenticating reverse proxy in front, enforce allowed hosts/origins with DNS-rebinding protection, and treat inbound MCP-caller identity and outbound Argo CD credentials as separate trust domains.