Argo CD MCP path traversal: prompt injection can delete repositories and clusters
Argo CD MCP 路径穿越：注入提示可删仓库和集群
In argoproj-labs' Argo CD MCP Server (argocd-mcp) version 0.9.0 and earlier, the delete_application tool does not validate applicationName, leading to a path traversal issue. An attacker or a prompt-injected model can pass path segments like ../repositories/ to send DELETE requests to other Argo CD APIs using the MCP's authenticated token, deleting repositories, clusters, or projects within the token's RBAC scope. NVD has registered it as CVE-2026-108585. X user @soycronus says it is not fixed as of 0.9.0 and recommends enabling MCP_READ_ONLY.
This CVE indicates that MCP tools may only expose deleting an application but can delete arbitrary resources; teams deploying Argo CD MCP can check tool permissions and read-only switches accordingly.