argocd-mcp Unauthenticated MCP Session Hijack via Exposed HTTP Transport
First seen Aug 31, 2026 · Updated Aug 31, 2026 · CVSS 10
argocd-mcp version 0.8.0 exposes its HTTP transport on all network interfaces without enforcing authentication on incoming MCP sessions, even when an ARGOCD_API_TOKEN is configured. Any attacker with network access to the listener can invoke the full MCP tool surface, leveraging the operator's stored Argo CD token to create applications, trigger syncs, and modify GitOps resources without any credentials of their own.
Technical Analysis
The vulnerability stems from argocd-mcp binding its MCP server to 0.0.0.0 rather than a loopback or restricted interface, combined with a missing authentication check on MCP session establishment. Because the server internally holds a privileged ARGOCD_API_TOKEN used to authenticate to the Argo CD API, any unauthenticated client that can reach the listener inherits the full permissions of that token, effectively bypassing Argo CD's own access controls. This allows remote attackers to enumerate and invoke all exposed MCP tools, including application creation, sync triggers, and resource mutation, enabling supply-chain-style tampering with deployed workloads. This is a direct MCP (Model Context Protocol) server flaw, meaning any AI agent or LLM-driven automation pipeline that relies on argocd-mcp as a tool endpoint is exposed to full takeover of its GitOps control plane, credential misuse, and unauthorized deployment actions performed under the agent's identity.
Affected Systems
argocd-mcp version 0.8.0 (and potentially earlier/later versions using the same HTTP transport binding behavior) deployed with ARGOCD_API_TOKEN configured; environments exposing the MCP HTTP listener on non-loopback interfaces without additional network-level access controls.
Indicators of Compromise
- N/A - configuration/design flaw, no known file hashes or C2 infrastructure; monitor for unexpected MCP tool invocations from unrecognized source IPs against argocd-mcp listener ports
Remediation Steps
- 1
Upgrade argocd-mcp
Apply the vendor patch or upgrade to a version that enforces authentication on MCP sessions and defaults to loopback-only binding.
- 2
Restrict network exposure
Bind the argocd-mcp HTTP transport to localhost or an internal-only interface; use firewall rules or network segmentation to block external access to the MCP listener port.
- 3
Rotate and scope API tokens
Rotate the ARGOCD_API_TOKEN and issue a least-privilege token scoped only to the operations argocd-mcp requires.
- 4
Add authentication/authorization layer
Place the MCP endpoint behind a reverse proxy or gateway that enforces mutual TLS, API keys, or OAuth before requests reach argocd-mcp.
- 5
Audit Argo CD activity
Review Argo CD application creation, sync, and resource modification logs for unauthorized or anomalous activity correlating with the exposure window.
- 6
Monitor agent tool integrations
For organizations using AI agents or automation pipelines that call argocd-mcp as a tool, audit which agents have access and constrain their network reachability to the MCP endpoint.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.