CVE-2026-82277: Argo Rollouts Dashboard Unauthenticated Mutating Operations
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running the Argo Rollouts dashboard through 1.10.0 are exposed if an attacker can reach the dashboard over the network. The dashboard binds to all interfaces, and the impact extends to every namespace the operator's kubeconfig can access.
What does an attacker need to exploit it?
An attacker needs network access to the dashboard. No authentication, authorization, user interaction, or CSRF protection is required to invoke the affected mutating operations.
What actions can an attacker perform?
An attacker can promote, abort, restart, retry, or undo Rollouts, and can set a Rollout image. These operations can be invoked across namespaces accessible through the operator's kubeconfig.