← Vulnerability feed

Vulnerability record · CVE-2026-45738 · published 15 July 2026

CVE-2026-45738: Argoproj argo cd cross-site scripting vulnerability

Argoproj · Argo Cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

8.7 CVSS 3.1 High EPSS 0.61% · top 53.1% CWE-79 · Cross-site scripting
8.7CVSS 3.1 base score
0.61%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
20 Jul 2026Last modified by NVD

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f Patch
https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122 Patch
https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6 Patch
https://github.com/argoproj/argo-cd/releases/tag/v3.2.12 Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.3.10 Release Notes
https://github.com/argoproj/argo-cd/releases/tag/v3.4.2 Release Notes
https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38 ExploitVendor Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38 ExploitVendor Advisory

Track CVE-2026-45738 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-29165Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with versi…EPSS 2.1%9.9CVE-2025-55190Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.…EPSS 5.5%9.8CVE-2024-21652Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chai…EPSS 0.75%9.6CVE-2026-42880Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a …EPSS 0.56%9.6CVE-2023-40029Argoproj argo cd information exposure vulnerabilityArgo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. …EPSS 1.2%9.6CVE-2022-31105Argoproj argo cd improper certificate validation vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 i…EPSS 0.78%9.1CVE-2024-21662Argoproj argo cd improper restriction of authentication attempts vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively by…EPSS 0.84%9.0CVE-2024-31989Argoproj argo cd broken cryptographic algorithm vulnerabilityArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2026-45738), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.