Argo CD: application annotations render as unvalidated hrefs, allowing javascript: execution in an admin session

Impact

A user who only holds application write access on one Argo CD application can plant a link.argocd.argoproj.io/* annotation whose pipe-separated value is rendered as an anchor href with no URL validation. When a higher-privileged operator opens that application's Summary tab, script runs in the authenticated Argo CD origin, so the low-privileged tenant inherits the admin's session against the whole control plane. On a GPU fleet where Argo CD is the thing that defines what runs on the nodes, that means an application-scoped tenant can reach manifests for other tenants' namespaces - node selectors, device plugin config, privileged pod specs. The scope-change in the vector is the point: the flaw crosses the privilege boundary Argo CD projects are supposed to enforce. Exploitation needs the admin to actually view the Summary tab.

Who can reach it

Authenticated Argo CD user with write access to any application, plus a higher-privileged user who later views that application's Summary tab in the web UI. No cluster access needed.

What to do

Upgrade Argo CD to 3.2.12, 3.3.10, or 3.4.2 - a control-plane component upgrade: roll the argocd-server deployment, no node disruption and no workload restart. Until then, audit existing link.argocd.argoproj.io/* annotations on applications and restrict application write access to trusted principals.

References

Related entries

• NGINX Ingress Controller: unsanitized CRD and annotation fields inject arbitrary NGINX directivesCVE-2026-55723 · NGINX Ingress Controller (configuration generator, CRDs and Ingress annotations)High
• Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0CVE-2026-55887 · Docker MCP Gateway (io.docker.server.metadata OCI label -> docker run arguments)High
• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
• Red Hat ACM lighthouse: unvalidated EndpointSlice IPs let a spoke cluster hijack cross-cluster service trafficCVE-2026-66787 · Red Hat Advanced Cluster Management lighthouse (cross-cluster service DNS)High
• Dockge: authenticated user reads or deletes arbitrary host directories via stack-name traversalCVE-2026-73040 · Dockge (Docker Compose stack manager, stack-name path traversal)High
• etcd: TCP connections that never send a ClientHello pile up goroutines until the process exhausts memoryCVE-2026-73500 · etcd (TLS listener acceptLoop pending-handshake tracking)High