The Argo CD MCP server — argocd-mcp, published under argoproj-labs — received CVE-2026-82456 on 29 August 2026 at 15:30:21 UTC, scored 10.0 on both CVSS 3.1 and CVSS 4.0. That is the maximum the scale allows. It is also, in the substantive sense, not new.

The fix predates the CVE by 18 days

The maintainers published their own advisory for the identical finding on 11 August at 15:47:14 UTC, marked "No known CVE", and shipped the patch in v0.9.0 fifteen minutes earlier, at 15:32:50 UTC the same day. They scored it 10.0 themselves. The 29 August record is the industry's numbering system catching up to a fix that had been public for more than two weeks.

What the score does not tell you

This is where the headline number misleads. The vulnerability — classified CWE-1327, binding to an unrestricted address — applies to version 0.8.0 when it is run with the HTTP or SSE transport: the listener bound to every interface and accepted MCP sessions with no authentication. But the transport is not the default anyone is steered toward. The project's installation snippets configure stdio, which is not reachable over a network at all. A 10.0 describes the worst case for a configuration the documentation does not hand you.

The underlying design problem is the interesting one

The 0.9.0 release does three things: it binds the HTTP and SSE listener to 127.0.0.1 by default, it adds a separate MCP_AUTH_TOKEN to authenticate inbound callers, and it stops treating the presence of an Argo CD credential as a form of access control. That last point is the real lesson. ARGOCD_API_TOKEN is an outbound credential — it authenticates the server to Argo CD. It never authenticated anyone calling the server. Version 0.8.0 shipped on 11 June, so operators running the network transport had a 61-day exposure window.

And the record is again unreadable by tooling

Exactly as with the Skyvern advisory published four minutes earlier, the GitHub advisory record for CVE-2026-82456 carries an empty structured vulnerabilities array — no package range, no first patched version. Two maximum-and-near-maximum severity findings on agent infrastructure landed the same afternoon, and neither can be matched to a lockfile automatically.