CVE-2026-45738
Full vulnerability record from the local CVENow database.
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Severity
HIGH
CVSS score
8.7
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-15 20:17:05.057000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-45738",
"sourceIdentifier": "[email protected]",
"published": "2026-07-15T20:17:05.057",
"lastModified": "2026-10-24T21:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2."
},
{
"lang": "es",
"value": "Argo CD es una herramienta de entrega continua declarativa, GitOps, para Kubernetes. Antes de las versiones 3.2.12, 3.3.10 y 3.4.2, los usuarios de Argo CD con acceso de escritura a la aplicación pueden establecer anotaciones link.argocd.argoproj.io/* cuyos valores separados por barras verticales son renderizados por ui/src/app/applications/components/application-summary/application-summary.tsx en la sección de URLs de la pestaña Summary como valores de atributo href de anclaje sin validación de URL, permitiendo la ejecución de javascript_disabled: en la sesión de origen autenticada de Argo CD de un usuario con mayores privilegios. Este problema está solucionado en las versiones 3.2.12, 3.3.10 y 3.4.2."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "argoproj",
"product": "argo-cd",
"versions": [
{
"version": "< 3.2.12",
"status": "affected"
},
{
"version": ">= 3.3.0, < 3.3.10",
"status": "affected"
},
{
"version": ">= 3.4.0-rc1, < 3.4.2",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-16T14:51:03.406825Z",
"id": "CVE-2026-45738",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.12",
"matchCriteriaId": "0E9E54C0-2E4C-444E-934A-AAF2475AFAAF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.3.0",
"versionEndExcluding": "3.3.10",
"matchCriteriaId": "055C2E56-09AD-4D88-9267-D08BF5C4ADA4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.0",
"versionEndExcluding": "3.4.2",
"matchCriteriaId": "896AD54E-AC47-40DD-BEC0-337DC0E446DC"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.2.12",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.3.10",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/argoproj/argo-cd/releases/tag/v3.4.2",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
]
}
]
}