Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-82277 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-28 |
| Vendor | Argo Project (CNCF) |
| Product | Argo Rollouts (dashboard), versions through 1.10.0 |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / VulnCheck
The Argo Rollouts dashboard through version 1.10.0 binds to all network interfaces and exposes deployment-mutating operations without authentication, authorization or CSRF protection.
An attacker with network access to the dashboard can invoke the full set of rollout control operations:
PromoteRollout— advance a rollout to the next stage,AbortRollout— abort a rollout in progress,RestartRollout— restart,SetRolloutImage— swap the container image,UndoRollout— revert to a previous version,RetryRollout— retry.
SetRolloutImage is the critical one. Argo Rollouts drives production deployments in Kubernetes, so being able to point it at an arbitrary container image means running attacker code in the cluster — with whatever privileges the replaced service holds.
The missing CSRF protection widens the vector: it is enough for an administrator with dashboard access to open a prepared web page.
Required Actions
- Upgrade Argo Rollouts beyond version 1.10.0.
- Verify which address the dashboard binds to. If the upgrade must wait, restrict the listener to loopback and expose the dashboard only via
kubectl port-forwardor an authenticating reverse proxy. - Review cluster NetworkPolicies — the dashboard should not be reachable from application pods or user networks.
- Review rollout history for operations that cannot be tied to a pipeline or a named operator. Image changes in particular.
Who Is Affected?
The vulnerability affects Argo Rollouts installations running the dashboard, in versions through 1.10.0.
Argo Rollouts is the CNCF tool for progressive delivery — canary and blue-green — in Kubernetes. It appears where deployment process maturity called for controlled release of changes: software houses, fintechs, e-commerce platforms and platform teams in larger organisations.
One pattern is worth noting: the Argo Rollouts dashboard is often started “for a moment” to inspect rollout state and then left running permanently. Because it requires no login, nobody reads its availability as a warning sign.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
