CVE-2026-45738

Analyzed Analyzed - Analysis Complete

javascript: Execution via Argo CD Annotations

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45738

Affected Vendors & Products

Vendor	Product	Version / Range
argoproj	argo_cd	to 3.2.12 (exc)
argoproj	argo_cd	From 3.3.0 (inc) to 3.3.10 (exc)
argoproj	argo_cd	From 3.4.0 (inc) to 3.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in Argo CD. Users with application write access can inject malicious JavaScript via link annotations (e.g., link.argocd.argoproj.io/*) in Kubernetes resources. These annotations are rendered as clickable links in the UI without proper URL validation, allowing execution of arbitrary JavaScript in a higher-privileged user's session.

Detection Guidance

To detect this vulnerability, inspect Kubernetes resources for malicious annotations like link.argocd.argoproj.io/* with pipe-separated values containing unsafe protocols (javascript:, data:, vbscript:). Check Argo CD UI Summary tab for suspicious links. Use commands like kubectl get all -A -o yaml | grep -E 'link.argocd.argoproj.io|javascript:' to search for such annotations in your cluster.

Impact Analysis

An attacker with developer write access could escalate privileges to admin by tricking an admin into clicking a malicious link in the Argo CD UI. This could lead to session hijacking, data exfiltration, or further compromise of the Kubernetes cluster via the admin's elevated session.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. A successful exploit may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade Argo CD to versions 3.2.12, 3.3.10, or 3.4.2 or later. Remove any suspicious annotations from resources. Review and validate all link annotations in your cluster. Monitor for unauthorized access or unusual activity in the Argo CD UI.

Hi! I’m here to help you understand CVE-2026-45738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70