CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

• CWE-79

• https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0fPatch
• https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122Patch
• https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6Patch
• https://github.com/argoproj/argo-cd/releases/tag/v3.2.12Release Notes
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.10Release Notes
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.2Release Notes
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38Exploit, Vendor Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38Exploit, Vendor Advisory

Published

Jul 15, 2026

Last Modified

Jul 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45729Thor Vector Graphics (ThorVG) is a production-ready vector g…4.3
• CVE-2026-4573A security vulnerability has been detected in SourceCodester…6.3
• CVE-2026-45731WWBN AVideo is an open source video platform. In 29.0 and ea…4.9
• CVE-2026-45732n8n is an open source workflow automation platform. Prior to…8.1
• CVE-2026-45736ws is an open source WebSocket client and server for Node.js…7.5
• CVE-2026-45737Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2026-45739Strawberry GraphQL is a library for creating GraphQL APIs. I…4.3
• CVE-2026-4574A vulnerability was detected in SourceCodester Simple E-lear…6.3
• CVE-2026-45740protobufjs compiles protobuf definitions into JavaScript (JS…7.5
• CVE-2026-45743Termix is a web-based server management platform with SSH te…8.1
• CVE-2026-45744Termix is a web-based server management platform with SSH te…9.9
• CVE-2026-45745Termix is a web-based server management platform with SSH te…8