https://vulnerability.circl.lu/sightings/feed 2026-10-11T23:49:42.500746+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6aa4319b-9658-4888-aaaf-9adac65e20af/export 2026-10-11T23:49:42.527539+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6aa4319b-9658-4888-aaaf-9adac65e20af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108585", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417556556754953", "content": "CVE-2026-108585 argocd-mcp through 0.9.0 Path Traversal via delete_application Tool argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108585https://hackmd.io/@haind/argocd-mcp-delete-application-route-smugglinghttps://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/client.ts#L115-L139https://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/http.ts#L86-L91https://github.com/argoproj-labs/mcp-for-argocdhttps://www.vulncheck.com/advisories/argocd-mcp-through-0.9.0-path-traversal-via-delete-application-tool#argoproj-labs #argocd-mcp#CVE_2026_108585#bot", "creation_timestamp": "2026-10-10T16:28:48.301709Z"} 2026-10-10T16:28:48.301709+00:00