The vulnerability is a path traversal flaw located in the delete_application tool of Argo CD MCP Server. The tool accepts an unvalidated applicationName argument, allowing attackers to embed dot‑segment components such as '../repositories/' that are interpreted by the underlying HTTP client as absolute URLs. This permits authenticated MCP clients to send DELETE requests to unintended API endpoints, resulting in the removal of repositories, clusters, or projects that the token’s RBAC policies allow. The flaw is classified as a path traversal weakness (CWE‑22) and can lead to data loss and service disruption.

Affected product is argoproj‑labs Argo CD MCP Server, versions 0.9.0 and earlier. The CVE impacts any deployment of the mcp‑for‑argocd repository containing the vulnerable delete_application implementation. Administrators must verify whether their MCP Server is within this version range and whether any clients use the delete_application command.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires the attacker to have a valid MCP token. There is no publicly available exploit footage, and the CVE is not listed in CISA’s KEV catalog. The EPSS is not published, so the predicted network exploitation probability is unknown, but the lack of external exploitation evidence suggests it is low. Attackers could still leverage automated prompt injection to supply the malicious path, so the risk remains present until a patch or mitigations are applied.