CVE-2026-108585 Details

A path traversal vulnerability has been identified in the Argo CD MCP Server, specifically in versions through 0.9.0. The issue arises within the delete_application tool, which allows MCP clients to access unintended API endpoints by sending unvalidated applicationName values. Attackers or prompt-injected models can exploit this by including dot-segment values, such as '../repositories/', to manipulate authenticated DELETE requests. This could lead to the deletion of repositories, clusters, or projects, depending on the permissions associated with the token used.

The vulnerability can be fixed by validating the applicationName input to ensure it does not include separators or dot-segments, and by encoding the value before it is added to the request path. Additionally, a post-resolution check can be implemented to verify that the final path aligns with the intended API collection before the request is sent.