---
id: CVE-2026-82277
title: >-
  Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes
  mutating Rollout operations without authentication, authorization, or CSRF
  protection
summary: >-
  Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes
  mutating Rollout operations without authentication, authorization, or CSRF
  protection. Attackers on the same network can invoke PromoteRollout,
  AbortRollout, Rest…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: argoproj
product: argo-rollouts
affected:
  - argo-rollouts <= 1.10.0
published: '2026-08-28'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82277'
references:
  - url: 'https://github.com/argoproj/argo-rollouts'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/argoproj/argo-rollouts/blob/4e6a2798688e22868340d9871a3c8d78371f1568/server/server.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/argoproj/argo-rollouts/issues/4747'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/argo-rollouts-dashboard-unauthenticated-mutating-operations
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00779
epssPercentile: 0.53962
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-31T16:46:45.934347Z'
ingestedAt: '2026-09-24T15:45:56.693Z'
---

## Overview

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.