Argo Rollouts exposes its dashboard on all interfaces without authentication, authorization, or CSRF protection. This flaw allows an attacker who can reach the dashboard from the same network to issue mutating Rollout commands such as PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout across any namespace reachable by the operator's kubeconfig. The result is the ability to arbitrarily modify deployment state, potentially causing service outages, reverting to older images, or introducing insecure configurations.

The vulnerability affects Argo Project’s Argo Rollouts component, specifically releases up to and including version 1.10.0. All environments that deploy the dashboard in these versions are susceptible unless the dashboard has been disabled or its interface has been further secured.

With a CVSS score of 9.3 the flaw is classified as critical. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, but lack of authentication and CSRF controls make exploitation trivial for any host that can reach the dashboard. The attack vector is likely local network based, requiring no special credentials. Because the operations affect all namespaces that the operator’s kubeconfig has access to, the potential impact spans the entire cluster, making the risk high for exposed installations.