Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-30 · source-backed
NVD published CVE-2026-82456 on August 29 at CVSS 10.0. The server binds its HTTP transport to every network interface and accepts MCP sessions with no caller credentials whenever ARGOCD_API_TOKEN is set, so anyone reaching the listener drives the full tool surface with the operator's [redacted] applications, request syncs, modify Argo CD resources. (NVD) This is the same failure I keep seeing in MCP servers, where holding a credential gets confused with having verified the caller.
Each link below shares sources, entities, or timing with this story.
Cloudflare supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Cloudflare supports MCP); both cover August, CVE, CVSS, HTTP; overlapping topics (august, cvss, server).
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover August, CVE, CVSS, NVD; overlapping topics (credential, cvss).
Context7 uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Context7 uses MCP); both cover August, CVE, CVSS, MCP; reported by the same outlet (nvd.nist.gov).
Context7 uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Context7 uses MCP); both cover August, HTTP, MCP; overlapping topics (anyone, august, authorization, credential).
Anthropic released MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Anthropic released MCP); both cover CVE, CVSS, HTTP, MCP; earlier CVE coverage from 2026-03-23.
Claude uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude uses MCP); both cover August, CVE, CVSS, NVD; reported by the same outlet (nvd.nist.gov).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVSS, MCP; overlapping topics (confused, credential, server).
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover August, HTTP, MCP; overlapping topics (caller, server).