CVE-2026-45738: Argo CD XSS Vulnerability

CVE-2026-45738 Overview

CVE-2026-45738 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Argo CD, the declarative GitOps continuous delivery tool for Kubernetes. Users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered without URL validation in the Application Summary tab. The unsanitized values become anchor href attributes, allowing javascript: URIs to execute in the browser session of any higher-privileged user who views the affected application. The flaw exists in ui/src/app/applications/components/application-summary/application-summary.tsx and is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Critical Impact
A low-privileged Argo CD user can escalate privileges by injecting javascript: payloads into application annotations, hijacking administrator sessions when they navigate to the Summary tab.

Affected Products

Argo CD versions prior to 3.2.12
Argo CD versions prior to 3.3.10
Argo CD versions prior to 3.4.2

Discovery Timeline

2026-07-15 - CVE-2026-45738 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45738

Vulnerability Analysis

Argo CD renders application metadata in its React-based web UI. Annotations prefixed with link.argocd.argoproj.io/ are treated as user-facing links and surfaced in the Summary tab URLs section. The React component application-summary.tsx parsed pipe-separated annotation values and injected them directly into anchor href attributes without validating the URL scheme. React does not automatically block javascript: URIs in href attributes, so any string beginning with javascript: is executed when the link is clicked. Because the payload runs inside the authenticated Argo CD origin, an attacker inherits the victim's session cookies, CSRF tokens, and API access.

Root Cause

The root cause is missing input validation on user-controlled URL data. The Summary tab component consumed annotation values and passed them to a rendered <a href={...}> element without checking that the scheme was http: or https:. The patch adds an isValidURL helper imported from shared/utils and applies it before rendering the link.

Attack Vector

Exploitation requires an authenticated Argo CD user with write access to at least one application. The attacker adds an annotation such as link.argocd.argoproj.io/malicious: javascript:fetch('/api/v1/session')...|Malicious Link to an application manifest. When a higher-privileged administrator opens the application's Summary tab and clicks the crafted link, the JavaScript executes in the administrator's session context. Attackers can then invoke the Argo CD API to create, sync, or delete applications, extract cluster credentials, or pivot into managed Kubernetes clusters.

text

// Patch adding URL scheme validation before rendering annotation links
 import {AuthSettingsCtx, Consumer, ContextApis} from '../../../shared/context';
 import * as models from '../../../shared/models';
 import {services} from '../../../shared/services';
+import {isValidURL} from '../../../shared/utils';

 import {ApplicationSyncOptionsField} from '../application-sync-options/application-sync-options';
 import {RevisionFormField} from '../revision-form-field/revision-form-field';
// Source: https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f

Detection Methods for CVE-2026-45738

Indicators of Compromise

Application manifests containing link.argocd.argoproj.io/* annotations with values starting with javascript:, data:, or other non-HTTP schemes.
Unexpected outbound requests from browsers of Argo CD administrators to attacker-controlled domains shortly after visiting an application Summary tab.
Argo CD audit log entries showing annotation writes from low-privileged accounts immediately followed by privileged API calls from the same origin.

Detection Strategies

Scan Argo CD application resources in Kubernetes for annotations matching the link.argocd.argoproj.io/ prefix and inspect values for non-HTTP URL schemes.
Enable and forward Argo CD API server audit logs and correlate applications.argoproj.io PATCH events against user role bindings.
Deploy a Content Security Policy (CSP) report-only header on the Argo CD UI and monitor script-src violations from inline handlers.

Monitoring Recommendations

Continuously inventory Argo CD versions across clusters and alert on any instance running below 3.2.12, 3.3.10, or 3.4.2.
Monitor Kubernetes admission events for annotation changes on Application custom resources by non-administrative service accounts.
Correlate browser session activity from privileged Argo CD users with sync, delete, and repository credential retrieval API calls.

How to Mitigate CVE-2026-45738

Immediate Actions Required

Upgrade Argo CD to version 3.2.12, 3.3.10, or 3.4.2, matching your current minor release track.
Audit existing Application resources for link.argocd.argoproj.io/* annotations and remove any values that do not use http: or https: schemes.
Review Argo CD RBAC and restrict applications, update and applications, create permissions to trusted users.

Patch Information

The Argo CD maintainers released fixes in v3.2.12, v3.3.10, and v3.4.2. The patch introduces an isValidURL check in application-summary.tsx that rejects annotation values whose scheme is not HTTP or HTTPS. See GitHub Security Advisory GHSA-h98r-wv3h-fr38 for full details and the primary fix commit.

Workarounds

Tighten Argo CD RBAC so that only vetted administrators can create or modify Application resources and their annotations.
Use a Kubernetes admission controller (OPA Gatekeeper or Kyverno) to reject Application objects whose link.argocd.argoproj.io/* annotation values do not match ^https?://.
Deploy a strict Content Security Policy in front of the Argo CD UI that disallows javascript: URIs and inline script execution.

bash

# Kyverno policy fragment blocking non-HTTP link annotations on Argo CD Applications
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-argocd-js-link-annotations
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-link-annotations
      match:
        any:
          - resources:
              kinds:
                - Application
              group: argoproj.io
      validate:
        message: "link.argocd.argoproj.io/* annotations must use http(s) URLs"
        pattern:
          metadata:
            =(annotations):
              "link.argocd.argoproj.io/*": "https://* | http://*"