CVE-2026-82277: fallo crítico en argoproj argo-rollouts
Argo Rollouts Dashboard Unauthenticated Mutating Operations
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.8%
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
argoproj · argo-rolloutsReferencias
https://github.com/argoproj/argo-rolloutshttps://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.gohttps://github.com/argoproj/argo-rollouts/issues/4747https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations