CVE-2026-45738

HighCVSS 8.7/10Last modified Oct 24, 2026

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
argoproj	argo-cd	< 3.2.12; >= 3.3.0, < 3.3.10; >= 3.4.0-rc1, < 3.4.2

References

https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0fPatch
https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122Patch
https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6Patch
https://github.com/argoproj/argo-cd/releases/tag/v3.2.12Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.3.10Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.4.2Release Notes
https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38Exploit, Vendor Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38Exploit, Vendor Advisory

Timeline

Published: Jul 15, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-457394.3Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote CVE-2026-45746.3A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User P CVE-2026-457407.5protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth CVE-2026-457417.5Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does CVE-2026-457427.5Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go s CVE-2026-457438.1Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in T CVE-2026-457449.9Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GE CVE-2026-457458.0Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Ter CVE-2026-457469.0Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the Fi CVE-2026-457477.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.1 CVE-2026-457489.8Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect`CVE-2026-457498.1Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable`