Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-45738: Argo CD: Developer-to-admin privilege escalation via malicious link
GHSA-h98r-wv3h-fr38
CVE-2026-45738
CVE-2026-45738
BIT-argo-cd-2026-45738
Summary
A developer with write access to an Argo CD application can create a link that, when clicked by an admin, executes arbitrary JavaScript in the admin's session, allowing the developer to access admin privileges. This is a serious security risk because it allows unauthorized access to sensitive data and actions. Argo CD users should ensure that developers do not have write access to applications that contain sensitive data or critical functionality.
What to do
- Update github.com argoproj to version 3.2.12.
- Update github.com argoproj to version 3.3.10.
- Update github.com argoproj to version 3.4.2.
- Update argo-cd to version 3.4.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | argoproj |
< 3.2.12 >= 3.3.0-rc1, <= 3.3.9 >= 3.4.0-rc1, <= 3.4.1 Fix: upgrade to 3.2.12
|
| go | github.com | argoproj | <= 2.14.21 |
| go | github.com | argoproj | <= 1.8.7 |
| – | argoproj | argo-cd | < 3.2.12 |
| – | argoproj | argo_cd |
< 3.2.12 >= 3.3.0, < 3.3.10 >= 3.4.0, < 3.4.2 cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* |
| Bitnami | – | argo-cd |
>= 3.4.0, < 3.4.2 Fix: upgrade to 3.4.2
|
Original title
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Original description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
ghsa CVSS3.1
7.3
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38
- https://github.com/advisories/GHSA-h98r-wv3h-fr38
- https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41c...
- https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325...
- https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f...
- https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-45738 URL
Published: 21 Jul 2026 · Updated: 21 Jul 2026 · First seen: 19 May 2026