CVE-2026-45738
published 2026-07-15CVE-2026-45738: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can…
PriorityP353high8.7CVSS 3.1
AVNACLPRLUIRSCCHIHAN
EPSS
0.61%
46.7th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | < 3.2.12 | 3.2.12 |
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | < 3.2.12 | 3.2.12 |
| argoproj | argo_cd | >= 3.3.0 < 3.3.10 | 3.3.10 |
| argoproj | argo_cd | >= 3.4.0 < 3.4.2 | 3.4.2 |
| github.com | argoproj_argo-cd | 0 – 1.8.7 | — |
| github.com | argoproj_argo-cd_v2 | 0 – 2.14.21 | — |
| github.com | argoproj_argo-cd_v3 | >= 0 < 3.2.12 | 3.2.12 |
| github.com | argoproj_argo-cd_v3 | >= 3.3.0-rc1 < 3.3.10 | 3.3.10 |
| github.com | argoproj_argo-cd_v3 | >= 3.4.0-rc1 < 3.4.2 | 3.4.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
argoproj Argo CD up to 3.2.11/3.3.9/3.4.1 Summary tab URLs section application-summary.tsx cross site scripting
vuldb·2026-07-15·CVSS 7.3
CVE-2026-45738 [HIGH] argoproj Argo CD up to 3.2.11/3.3.9/3.4.1 Summary tab URLs section application-summary.tsx cross site scripting
A vulnerability categorized as problematic has been discovered in argoproj Argo CD up to 3.2.11/3.3.9/3.4.1. This issue affects some unknown processing of the file ui/src/app/applications/components/application-summary/application-summary.tsx of the component Summary tab URLs section. Such manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-45738. The attack may be launched remotely. There is no exploit available.
GHSA
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
ghsa·2026-05-19
CVE-2026-45738 [HIGH] CWE-79 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
### Summary
A user with **application write access (developer role)** can set `link.argocd.argoproj.io/*` annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab's **URLs section** as `` elements without URL validation. Using the pipe-separator trick (`Display Text | javascript:...`), an attacker can inject a `javascript:` URI while displaying a legitimate-looking label (e.g. `GitHub Repo`). When a higher-privileged user (admin) clicks the link, **arbitrary JavaScript executes in the ArgoCD origin context** in the admin's authenticated session context, enabling API exfiltration and privilege escalation from developer to admin.
### Details
**Vulnerab
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0fhttps://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6https://github.com/argoproj/argo-cd/releases/tag/v3.2.12https://github.com/argoproj/argo-cd/releases/tag/v3.3.10https://github.com/argoproj/argo-cd/releases/tag/v3.4.2https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38
2026-07-15
Published