argocd-mcp: path traversal in delete_application lets a client delete repositories, clusters or projects

Impact

The delete_application tool interpolates the caller-supplied applicationName into the Argo CD API path without validating it, so a dot-segment value such as ../repositories/ redirects an authenticated DELETE to a different Argo CD endpoint. Anything the MCP server's token can delete under RBAC becomes reachable: repository registrations, cluster registrations, projects. The attacker does not have to be a person - a prompt-injected model driving the MCP server supplies the value, which is the realistic path here. For a fleet that deploys GPU nodes through GitOps, losing cluster or repository registrations breaks the reconciliation loop and the deployment pipeline for the whole estate until an operator rebuilds them by hand; the record scores it as integrity and availability impact, not disclosure.

Who can reach it

Network, authenticated as an MCP client of the Argo CD MCP server; also reachable indirectly through prompt injection into any model that holds that MCP connection. The damage ceiling is whatever the server's Argo CD token is permitted to delete.

What to do

No fixed version is named - the advisory covers argocd-mcp through 0.9.0 and the references point at the unvalidated code paths rather than a release. Mitigate: scope the Argo CD token the MCP server uses down to the single application set it needs and remove delete rights on repositories, clusters and projects; or disable the delete_application tool; or stop exposing the MCP server to untrusted prompt content. This is a configuration and token-scope change plus a restart of the MCP server process, not a cluster operation.

References

Related entries

• kuma-dp: readiness port 9902 proxies the Envoy admin API to the pod network with no authenticationCVE-2026-18673 · Kong Mesh / kuma-dp readiness service on TCP 9902 (Envoy admin proxy)Medium
• containerd: Crafted image causes DoS during container creationCVE-2026-47262 · containerdMedium
• Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout): An actor who can influence theCVE-2026-47680 · Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout)Medium
• Envoy Gateway: unsynchronized Wasm cache map read/write crashes the controller processCVE-2026-53715 · Envoy Gateway controller (internal/wasm HTTP server, port 18002)Medium
• Podman: Malicious image WORKDIR symlink creates directories or changes ownership on the host filesystemCVE-2026-55686 · PodmanMedium
• BuildKit: invalid SecurityMode disables Seccomp and AppArmor without the insecure entitlementCVE-2026-61711 · BuildKit executor/oci/spec_linux.go (SecurityMode validation)Medium