Login Request a demo
High severity · published Jul 15, 2026
CVE-2026-45738
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
argo-cd · argoproj
< 3.2.12; >= 3.3.0, < 3.3.10; >= 3.4.0-rc1, < 3.4.2 · source: vendor
AC
Argo CD · Argoproj
before 3.2.12; 3.3.0 before 3.3.10; 3.4.0 before 3.4.2 · source: NVD
Affected product
AR
argo-cd
argoproj
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45738
Patch
https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f
Patch
https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122
Patch
https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6
Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
More from argo-cd
10.0
CVE-2022-29165
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
9.9
CVE-2026-113709
Argo CD: A Kustomize Helm config home can run commands in the repo-server
9.9
CVE-2026-113708
Argo CD: A Kustomize remote ref can run commands in the repo-server
9.9
CVE-2026-113672
Argo CD: A Jsonnet import can read files from the repo-server
9.9
CVE-2026-77459
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks