CVE-2026-45738

8.7 highEPSS 0.6%

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS 3.1: 8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)
CWE: CWE-79
Published: 2026-07-15
Modified: 2026-10-24
Record from: the NVD, synced 2026-10-25

Affected

argoproj:argo_cd

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-h98r-wv3h-fr38	Go	github.com/argoproj/argo-cd/v3	<3.2.12	3.2.12
GHSA-h98r-wv3h-fr38	Go	github.com/argoproj/argo-cd/v3	>=3.3.0-rc1 <3.3.10	3.3.10
GHSA-h98r-wv3h-fr38	Go	github.com/argoproj/argo-cd/v3	>=3.4.0-rc1 <3.4.2	3.4.2
GHSA-h98r-wv3h-fr38	Go	github.com/argoproj/argo-cd/v2	<=2.14.21	no fix published
GHSA-h98r-wv3h-fr38	Go	github.com/argoproj/argo-cd	<=1.8.7	no fix published
GO-2026-5418	Go	github.com/argoproj/argo-cd	all versions	no fix published
GO-2026-5418	Go	github.com/argoproj/argo-cd/v2	all versions	no fix published
GO-2026-5418	Go	github.com/argoproj/argo-cd/v3	<3.2.12 >=3.3.0-rc1 <3.3.10 >=3.4.0-rc1 <3.4.2	3.2.12, 3.3.10, 3.4.2

References

Check your stack JSON