CVE Feed

    Dashboard / CVE / CVE-2026-82277

    CVE-2026-82277

    Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

    Published:Aug 28, 2026
    Last Modified:Sep 1, 2026
    EPS:Aug 28, 2026
    EPSS Score:0.00432
    CVSS Score:9.8

    Affected Products

    Vendor
    Argoproj
    Product
    Argo-rollouts

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High