CVE-2026-45738 – Argo CD
“A trusted interface can become an attack vector when user-supplied links are left unchecked.”
Argo CD addresses CVE-2026-45738, a cross-site scripting (XSS) vulnerability affecting versions prior to 3.2.12, 3.3.10, and 3.4.2. The flaw allows users with application write access to define link.argocd.argoproj.io/* annotations that are rendered as hyperlink values without URL validation. An attacker can abuse this behavior to execute malicious JavaScript within a higher-privileged user’s authenticated Argo CD session. The vulnerability is associated with CWE-79 (Cross-Site Scripting).
The CVSS score is 7.3, which is High severity. Based on the information provided, a public proof-of-concept (PoC) is available for this vulnerability. The issue is resolved in Argo CD 3.2.12, 3.3.10, and 3.4.2.
Key Details
- Affected Product
- Argoproj Argo Cd
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- Required
- CWE Classification
- CWE-79