CVE-2026-108585: argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Argo CD MCP Server through 0.9.0 are exposed when an MCP client can invoke the delete_application tool using an authenticated token. The impact is limited by the RBAC permissions assigned to that token.
What does an attacker need to exploit it?
The attacker needs the ability to supply the applicationName argument to delete_application, directly or through a prompt-injected model. They can use dot-segment path values such as ../repositories/ to redirect an authenticated DELETE request to unintended API endpoints.
What could be deleted through exploitation?
An attacker can target repositories, clusters, or projects if the MCP server's authenticated token is authorized to delete those resources. The vulnerability does not grant permissions beyond that token's RBAC scope.