The disclosed argocd-mcp delete_application operation interpolates its applicationName argument into an authenticated Argo CD API URL. A malicious value containing path traversal segments can change the REST resource selected after URL normalization. Depending on the permissions of the configured Argo CD token, the resulting DELETE could reach a repository,…
Inspect the ClaimsCase · DiggingBeagle record
Argo CD MCP tool path traversal could target other deletion endpoints
A published CVE describes how unvalidated application names passed to the delete_application MCP tool could route an authenticated DELETE to an unintended Argo CD API endpoint.
Scope
CVE-2026-108585 concerns argocd-mcp versions through 0.9.0, published October 10, 2026. The disclosed impact is bounded by the Argo CD token's existing RBAC rights; no confirmed exploitation or named affected deployment was established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The CNA CVE specifies an unvalidated route-construction issue and RBAC-bounded consequences. The linked canonical disclosure does not verify production deletion, a victim incident or a fully remediated release. No code or remote target was run in this session.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ARGO-MCP-DELETE-ROUTE · CLM-ARGO-MCP-RBAC-BOUND · CLM-ARGO-MCP-FIX-NOT-VERIFIED · CVE-2026-108585: Argo CD MCP delete_application path traversal
At a glance
An application-level tool name is not an authorization boundary: the exact normalized HTTP method, path and target resource must be checked before forwarding credentials. Enforce object-type allowlists and least-privilege Argo CD tokens so a model-supplied application name cannot unexpectedly select a different resource class. Keep the downstream RBAC bound…
Read the implicationsThe exact fixed argocd-mcp release or accepted patch has not been established from the scoped CVE source. A destructive deletion on a live Argo CD API has not been independently verified here. No confirmed malicious campaign or prompt-injected agent performing these deletions is documented by the consulted record.
Limits and uncertaintyFull account
The disclosed argocd-mcp delete_application operation interpolates its applicationName argument into an authenticated Argo CD API URL. A malicious value containing path traversal segments can change the REST resource selected after URL normalization. Depending on the permissions of the configured Argo CD token, the resulting DELETE could reach a repository, project or cluster endpoint although the MCP tool label promises deletion of an application. The CVE identifies versions through 0.9.0 and describes the possible effect, but the available evidence must not be reported as a confirmed production deletion or prompt-injection incident.
Mechanism and trust boundary
- 01
Client supplies applicationName
A user or compromised model submits a value intended for delete_application.
Boundary: model/tool parameter to MCP server
- 02
HTTP client resolves dot segments
The unvalidated value changes the target endpoint during path construction.
Boundary: tool-level operation name to underlying REST resource
- 03
Authenticated deletion is attempted
The Argo CD token authorizes or rejects deletion according to its RBAC scope.
Boundary: MCP service token to Argo CD API authorization
Claims & evidence
CLM-ARGO-MCP-AFFECTEDThe published affected range for CVE-2026-108585 is argocd-mcp through version 0.9.0.supported
Basis: reported finding
- supportsCVE-2026-108585: Argo CD MCP delete_application path traversalprimary disclosure
Affected Systems and raw CVE containers.cna.affected versions lessThanOrEqual 0.9.0
CLM-ARGO-MCP-RBAC-BOUNDThe described consequences include deletion of Argo CD repositories, clusters or projects only within the permissions of the token used by the MCP server.supported
Basis: reported finding
- supportsCVE-2026-108585: Argo CD MCP delete_application path traversalprimary disclosure
CVE raw CNA description, consequence clause and page Description
CLM-ARGO-MCP-DELETE-ROUTEThe CVE record states that unvalidated applicationName values in argocd-mcp's delete_application MCP tool can traverse to unintended Argo CD API endpoints while using the configured authenticated client.supported
Basis: reported finding
- supportsCVE-2026-108585: Argo CD MCP delete_application path traversalprimary disclosure
CVE raw CNA description, containers.cna.descriptions[0] and page Description
CLM-ARGO-MCP-FIX-NOT-VERIFIEDThe retrieved CVE record does not identify a specific patched version or verify remediation, and the current public evidence examined here does not establish in-the-wild exploitation.supported
Basis: inference
- supportsCVE-2026-108585: Argo CD MCP delete_application path traversalprimary disclosure
CVE record: Remediation, no solution or workaround provided; Tracking, no KEV
Implications
An application-level tool name is not an authorization boundary: the exact normalized HTTP method, path and target resource must be checked before forwarding credentials. Enforce object-type allowlists and least-privilege Argo CD tokens so a model-supplied application name cannot unexpectedly select a different resource class. Keep the downstream RBAC bound explicit; neither a working path rewrite nor an advisory automatically proves destructive action on a live installation.
Controls and mitigations
- Restrict deletion rights of the token supplied to the MCP server.
- Validate application names against path traversal and unexpected path normalization before generating API requests.
- Monitor destructive Argo CD API calls and verify the requested object type, not just the MCP tool name.
- Track maintainer remediation rather than assuming a fixed version that the consulted CVE did not identify.
Unknowns and contradictions
- The exact fixed argocd-mcp release or accepted patch has not been established from the scoped CVE source.
- A destructive deletion on a live Argo CD API has not been independently verified here.
- No confirmed malicious campaign or prompt-injected agent performing these deletions is documented by the consulted record.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 132