CVE-2026-82277

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82277
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82277.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82277
Published
2026-08-28T16:18:58Z
Modified
2026-09-02T03:30:53Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Argo Rollouts Dashboard Unauthenticated Mutating Operations
Details

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82277.json"
}
References

Affected packages

Git / github.com/argoproj/argo-rollouts

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-rollouts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d90700ae8d71d141561f0c546e19f999bb335cbd
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.10.0"
        },
        {
            "fixed": "1.10.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v1.*
v1.0.0
v1.0.0-rc1
v1.0.1
v1.0.2
v1.1.0
v1.1.0-rc1
v1.1.0-rc2
v1.10.0-rc1
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.3.0-rc1
v1.4.0-rc1
v1.5.0-rc1
v1.6.0-rc1
v1.7.0-rc1
v1.8.0-rc1
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82277.json"