Aller au contenu
en Se connecter
7.3 Élevée

CVE-2026-45738 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
argo-cd 3.4 3.4.0-rc1 → < 3.4.2 3.4.2
argo-cd 3.3 3.3.0 → < 3.3.10 3.3.10
argo-cd 3.2 premières → < 3.2.12 3.2.12

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de argo-cd

Les 49 CVE de argo-cd →
CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critique CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critique CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critique CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critique
Suivre cette CVE