CVE-2026-45738: Argo CD stored XSS in application link annotations

CVE-2026-45738 · Severity: high · CVSS 7.3 · Published 2026-07-15

Argo CD is a continuous delivery tool used to manage and deploy applications to Kubernetes clusters. A security vulnerability allows users with basic application write access to inject malicious scripts into the management interface. If a more privileged user, such as an administrator, views the affected application summary, the script could execute in their session, potentially allowing the attacker to perform administrative actions or access sensitive data.

Technologies: Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go), github.com/argoproj/argo-cd/v3 (Go). Vendors: Argo Project, Go.

Quick answers

Is CVE-2026-45738 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45738 being exploited in the wild.
How severe is CVE-2026-45738?
High severity, with a CVSS score of 7.3, published 15 July 2026.
Which products and versions are affected?
Argo Project Argo CD <= 1.8.7, <= 2.14.21, >= 3.3.0-rc1, <= 3.3.9, >= 3.4.0-rc1, <= 3.4.1, < 3.2.12; github.com/argoproj/argo-cd (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.8.7; github.com/argoproj/argo-cd/v2 (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.14.21; github.com/argoproj/argo-cd/v3 (Go) SEMVER:introduced=0,fixed=3.2.12, SEMVER:introduced=0,fixed=3.2.12,introduced=3.3.0-rc1,fixed=3.3.10,introduced=3.4.0-rc1,fixed=3.4.2.
Is there a fix for CVE-2026-45738?
Yes. github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.12, 3.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45738 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45738?
Check whether you run Argo Project Argo CD, github.com/argoproj/argo-cd (Go), github.com/argoproj/argo-cd/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/argoproj/argo-cd/v3 (Go): upgrade to 3.2.12, 3.4.2 or later
    go get github.com/argoproj/argo-cd/v3@v3.4.2

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Argo CD's application summary component. The root cause is a lack of URL validation for pipe-separated values in 'link.argocd.argoproj.io/*' annotations, which are rendered as anchor href values in the UI. An attacker with application write permissions can set these annotations to include 'javascript:' URIs. When a higher-privileged user views the Summary tab of the affected application, the malicious script executes within their authenticated session. This can lead to session hijacking or unauthorized administrative actions. The issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Affected products

  • argoproj Argo CD < 3.2.12, >= 3.3.0 < 3.3.10, >= 3.4.0-rc1 < 3.4.2

Identifiers

  • CVE-2026-45738
  • GHSA-h98r-wv3h-fr38
  • GO-2026-5418

Timeline

  • 2026-07-15: disclosed
  • 2026-07-15: advisory
  • 2026-05-12: patched: Initial patch release for 3.3.x and 3.4.x branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.