Description
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
argoproj-labs argocd-mcp
Default version status: unaffected
0 to ≤ 0.9.0affected
pkg:npm/argocd-mcpReferences
- https://hackmd.io/@haind/argocd-mcp-delete-application-route-smuggling ↗
- https://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/client.ts#L115-L139 ↗
- https://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/http.ts#L86-L91 ↗
- https://github.com/argoproj-labs/mcp-for-argocd ↗
- https://www.vulncheck.com/advisories/argocd-mcp-through-0.9.0-path-traversal-via-delete-application-tool ↗