argo-rollouts :: RBAC ATLAS

Image CVEs: Trivy 0.76.1 + cve.now enrichment, as of 2026-11-06. Default chart images only; a CVE in an image is not proof it is exploitable in this workload. Methodology

Description

A Helm chart for Argo Rollouts

https://github.com/argoproj/argo-rollouts

Overview

Identity	Namespace	Automount	Secrets	Permissions	Workloads	Risk
`argo-rollouts`	default		—	47	1	Critical

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

`argo-rollouts`

Namespace: default | Automount:

Permissions (47)

Role	Resource	Verbs	Risk	Tags
ClusterRole `argo-rollouts`	batch/jobs	create · delete · get · list · patch · update · watch	Critical	PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole `argo-rollouts`	core/secrets	get · list · watch	Critical	ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole `argo-rollouts`	core/configmaps	create · get · list · update · watch	High	ConfigMapAccess DataExposure InformationDisclosure
ClusterRole `argo-rollouts`	networking.gloo.solo.io/routetables	*	High	ClusterWideAccess WildcardPermission
ClusterRole `argo-rollouts`	getambassador.io/ambassadormappings	create · delete · get · list · update · watch	Low
ClusterRole `argo-rollouts`	x.getambassador.io/ambassadormappings	create · delete · get · list · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/analysisruns	create · delete · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/analysisruns/finalizers	create · delete · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/analysistemplates	get · list · watch	Low
ClusterRole `argo-rollouts`	apisix.apache.org/apisixroutes	get · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/clusteranalysistemplates	get · list · watch	Low
ClusterRole `argo-rollouts`	apps/deployments	get · list · update · watch	Low
ClusterRole `argo-rollouts`	core/deployments	get · list · update · watch	Low
ClusterRole `argo-rollouts`	networking.istio.io/destinationrules	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	core/endpoints	get	Low
ClusterRole `argo-rollouts`	core/events	create · patch · update	Low
ClusterRole `argo-rollouts`	argoproj.io/experiments	create · delete · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/experiments/finalizers	create · delete · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	gateway.networking.k8s.io/grpcroutes	get · list · update · watch	Low
ClusterRole `argo-rollouts`	projectcontour.io/httpproxies	get · list · update · watch	Low
ClusterRole `argo-rollouts`	gateway.networking.k8s.io/httproutes	get · list · update · watch	Low
ClusterRole `argo-rollouts`	extensions/ingresses	create · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	networking.k8s.io/ingresses	create · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	coordination.k8s.io/leases	create · get · update	Low
ClusterRole `argo-rollouts`	getambassador.io/mappings	create · delete · get · list · update · watch	Low
ClusterRole `argo-rollouts`	x.getambassador.io/mappings	create · delete · get · list · update · watch	Low
ClusterRole `argo-rollouts`	core/pods	list · update · watch	Low
ClusterRole `argo-rollouts`	core/pods/eviction	create	Low
ClusterRole `argo-rollouts`	apps/podtemplates	get · list · update · watch	Low
ClusterRole `argo-rollouts`	core/podtemplates	get · list · update · watch	Low
ClusterRole `argo-rollouts`	apps/replicasets	create · delete · get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/rollouts	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/rollouts/finalizers	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	argoproj.io/rollouts/status	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	core/services	create · delete · get · list · patch · watch	Low
ClusterRole `argo-rollouts`	eks.amazonaws.com/targetgroupbindings	get · list	Low
ClusterRole `argo-rollouts`	elbv2.k8s.aws/targetgroupbindings	get · list	Low
ClusterRole `argo-rollouts`	gateway.networking.k8s.io/tcproutes	get · list · update · watch	Low
ClusterRole `argo-rollouts`	gateway.networking.k8s.io/tlsroutes	get · list · update · watch	Low
ClusterRole `argo-rollouts`	traefik.containo.us/traefikservices	get · update · watch	Low
ClusterRole `argo-rollouts`	traefik.io/traefikservices	get · update · watch	Low
ClusterRole `argo-rollouts`	split.smi-spec.io/trafficsplits	create · get · patch · update · watch	Low
ClusterRole `argo-rollouts`	gateway.networking.k8s.io/udproutes	get · list · update · watch	Low
ClusterRole `argo-rollouts`	appmesh.k8s.aws/virtualnodes	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	appmesh.k8s.aws/virtualrouters	get · list · patch · update · watch	Low
ClusterRole `argo-rollouts`	appmesh.k8s.aws/virtualservices	get · list · watch	Low
ClusterRole `argo-rollouts`	networking.istio.io/virtualservices	get · list · patch · update · watch	Low

Potential Abuse (8)

The following security risks were found based on the above permissions:

Workloads (1)

Kind	Name	Container	Image
Deployment	argo-rollouts	argo-rollouts	quay.io/argoproj/argo-rollouts:v1.10.2 Moderate 0 critical · 9 high Top 8 of 23 CVEs GHSA-hrxh-6v49-42gf High CVSS 8.8 google.golang.org/grpc fixed in 1.82.1 CVE-2026-84304 High CVSS 8.7 google.golang.org/grpc fixed in 1.83.1 CVE-2026-84445 High CVSS 8.7 google.golang.org/grpc fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3 +1 CVE-2026-29181 High CVSS 7.5 go.opentelemetry.io/otel fixed in 1.41.0 CVE-2026-56851 High CVSS 7.5 golang.org/x/text fixed in 0.41.0 CVE-2026-56852 High CVSS 7.5 golang.org/x/text fixed in 0.39.0 CVE-2026-56854 High CVSS 7.5 golang.org/x/crypto fixed in 0.55.0 CVE-2026-63209 High CVSS 7.5 github.com/klauspost/compress fixed in 1.18.7 OS debian 12.15 · fixable: 0 critical, 9 high · scanned 2026-11-06 as `quay.io/argoproj/argo-rollouts:v1.10.2`