Executive brief
Argo CD is a continuous delivery tool used to manage and deploy applications to Kubernetes clusters. A security vulnerability allows users with basic application write access to inject malicious scripts into the management interface. If a more privileged user, such as an administrator, views the affected application summary, the script could execute in their session, potentially allowing the attacker to perform administrative actions or access sensitive data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Argo CD's application summary component. The root cause is a lack of URL validation for pipe-separated values in 'link.argocd.argoproj.io/*' annotations, which are rendered as anchor href values in the UI. An attacker with application write permissions can set these annotations to include 'javascript:' URIs. When a higher-privileged user views the Summary tab of the affected application, the malicious script executes within their authenticated session. This can lead to session hijacking or unauthorized administrative actions. The issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Affected products
- argoproj Argo CD < 3.2.12, >= 3.3.0 < 3.3.10, >= 3.4.0-rc1 < 3.4.2
Timeline
- 2026-07-15: disclosed
- 2026-07-15: advisory
- 2026-05-12: patched: Initial patch release for 3.3.x and 3.4.x branches
References
- https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f
- https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122
- https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6
- https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38