Stored XSS via link annotations in ArgoCD enabling privilege escalation (CVE-2026-45738)

A user with developer-role application write access can set `link.argocd.argoproj.io/*` annotations containing `javascript:` URIs using a pipe-separator trick, which are rendered as `<a href>` elements in the application Summary tab without URL validation. When an administrator clicks the crafted link, arbitrary JavaScript executes in the ArgoCD origin context within the admin's authenticated session, enabling API exfiltration and privilege escalation from developer to admin. The payload persists in the Kubernetes Application resource and ArgoCD's default Content Security Policy provides no XSS execution mitigation. Affected versions: - < 3.0.0 We recommend updating to: 3.2.12, 3.3.10, 3.4.2. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38 Details: https://vuln.today/cve/CVE-2026-45738