CVE-2026-45738

This flaw lets someone who can edit an Argo CD application add a booby-trapped link. If an administrator opens it, the attacker can act through that administrator's signed-in session—like slipping a forged instruction into a manager's inbox that appears to come from inside the company.

This matters to you if you use Argo CD to manage software deployments and allow developers or other users to edit applications. It is only a risk if someone with application write access can get an administrator to open the affected application page.

A user who can edit applications can target an administrator's browser session, so treat this as a prompt upgrade. There is no record of active exploitation, no public exploit code, and it is not listed in CISA's known-exploited catalog, which supports an amber—not emergency—priority.

Confirm the deployed Argo CD version and identify users or automation accounts with application write permission. Review applications for link.argocd.argoproj.io/* annotations, especially values containing unexpected URL schemes such as javascript:.

Upgrade within the applicable release branch: 3.2.x to 3.2.12 or later, 3.3.x to 3.3.10 or later, and 3.4.x to 3.4.2 or later. Test the upgrade in your normal staging process, as release upgrades may include changes unrelated to this fix.

If patching is delayed, remove or block untrusted application-link annotations and limit application write permission to trusted users. Review Argo CD audit records, application changes, and administrator activity for suspicious link additions or unexpected configuration changes. CISA has not assigned a KEV remediation due date.

CVE-2026-45738 is rated CVSS 7.3 High (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) and is CWE-79 stored cross-site scripting. An authenticated user with application write access can store a malicious javascript: URL in link.argocd.argoproj.io/* annotations; when a higher-privileged user opens the Summary tab, code executes in that user's authenticated Argo CD origin. CISA KEV does not list this CVE, no public exploit code is recorded, and EPSS is 0.6% with a flat trend.