CVE-2026-45738: argo cd before 3.2.12 (exclusive), from 3.3.0 (inclusive), before 3.3.10 (exclusive), from 3.4.0 (inclusive), before…

Affected technology

argo cd · before 3.2.12 (exclusive)
argoproj

argo cd · from 3.3.0 (inclusive), before 3.3.10 (exclusive)
argoproj

argo cd · from 3.4.0 (inclusive), before 3.4.2 (exclusive)
argoproj

argo-cd · < 3.2.12, >= 3.3.0, < 3.3.10, >= 3.4.0-rc1, < 3.4.2
argoproj

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. Vendor/CNA’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none.