Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-45738 · Microsoft / collected KEV context

GHSA-h98r-wv3h-fr38

BIT-argo-cd-2026-45738

GO-2026-5418

cve-program · CVE-2026-45738

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38
• https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f
• https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122
• https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6
• https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.2

nvd · CVE-2026-45738

• https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f
• https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122
• https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6
• https://github.com/argoproj/argo-cd/releases/tag/v3.2.12
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.10
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38

osv · GHSA-h98r-wv3h-fr38

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38
• https://github.com/argoproj/argo-cd

osv · GO-2026-5418

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38

No related operational record is retained in the current change model.