CVE-2026-45738High· 7.3▾ TwilightArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rende…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.6%
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
argo_cd < 3.2.12argo_cd >= 3.3.0, < 3.3.10argo_cd >= 3.4.0, < 3.4.2Upgrade past the affected range:
argo_cd 3.4.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45737Medium· 6.3Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2026-23960Medium· 5.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes
CVE-2025-59531High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2025-59537High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2025-59538High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2019-1973Medium· 4.8A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface