Argo Rollouts Dashboard Vulnerability: Critical CVE-2026-82277 Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- argo-rollouts (npm)
- Affected versions
- >= v1.10.0, <= v1.10.0 or >= stable, <= stable or >= v1.10.0-rc1, <= v1.10.0-rc1 or >= v1.9.0-rc1, <= v1.9.0-rc1 or >= v1.8.0-rc1, <= v1.8.0-rc1 or >= v1.7.0-rc1, <= v1.7.0-rc1 or >= v1.6.0-rc1, <= v1.6.0-rc1 or >= v1.5.0-rc1, <= v1.5.0-rc1 or >= v1.4.0-rc1, <= v1.4.0-rc1 or >= v1.3.0-rc1, <= v1.3.0-rc1 or >= v1.2.0, <= v1.2.0 or >= v1.2.0-rc2, <= v1.2.0-rc2 or >= v1.2.0-rc1, <= v1.2.0-rc1 or >= v1.1.0, <= v1.1.0 or >= v1.1.0-rc2, <= v1.1.0-rc2 or >= v1.1.0-rc1, <= v1.1.0-rc1 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-rc1, <= v1.0.0-rc1 or >= v0.2.0, <= v0.2.0 or >= v0.1.0, <= v0.1.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Argo Rollouts dashboard. Versions up to 1.10.0 are reportedly affected.
What happened
The Argo Rollouts dashboard through version 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. This vulnerability allows attackers on the same network to perform various Rollout operations across all namespaces accessible to the operator's kubeconfig.
The vulnerability, tracked as CVE-2026-82277, has a CVSS score of 9.8 and is classified as critical. It was first flagged on 2026-08-28T20:20:18.760000+00:00. The exploit has not been reported in the wild as of now.
To assess your exposure, check if your deployment includes the Argo Rollouts dashboard version 1.10.0 or earlier. If so, you are potentially vulnerable to unauthorized Rollout operations.
What to do about it
- Upgrade to a version of Argo Rollouts that fixes the vulnerability.
- Ensure proper network segmentation to prevent unauthorized access.
- Monitor the primary sources for updates on a patched version.
- Review your network security policies to ensure they align with the recommended actions.
How 0Day would have caught this
argo-rollouts is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your deployment includes the Argo Rollouts dashboard version 1.10.0 or earlier.
What should I do right now?
Upgrade to a version of Argo Rollouts that fixes the vulnerability and ensure proper network segmentation to prevent unauthorized access.
Is there a patched version available?
No official fix has been published yet. Monitor the sources for updates.