StackRadar

CVE-2026-45738

High

Advisory

Published 19 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.3
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
27
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 3
affected packages

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Carried by container images the latest versions of 27 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
github.com/argoproj/argo-cd/v2golangv2.4.7, v2.4.11, v2.7.2, v2.7.8+7 moreno fix listed15
github.com/argoproj/argo-cd/v3golangv3.0.3, v3.0.5, v3.1.1, v3.1.2+1 more3.2.12, 3.3.105
github.com/argoproj/argo-cdgolangv1.5.8no fix listed1
OSV records
GHSA-h98r-wv3h-fr38
Also known as
BIT-argo-cd-2026-45738, GO-2026-5418

Charts affected

27 by stars
ChartLatestAffected imagesRadar Score
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.2.12

Open the chart page →

5,240
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
no fix listed

Open the chart page →

3,793
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
no fix listed

Open the chart page →

10,315
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.2.12

Open the chart page →

954
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed

Open the chart page →

1,483
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.2.12

Open the chart page →

10,037
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

7,300
capsule-argo-addoncapsule-argo-addonVerified publisher0.7.51 of 2See more

capsule-argo-addon capsule-argo-addon 0.7.5

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
github.com/argoproj/argo-cd/v3@v3.1.2
3.2.12

Open the chart page →

2,038
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercddevtron0.10.21 of 2See more

devtron-in-clustercd devtron 0.10.2

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercddevtron-labs0.10.21 of 2See more

devtron-in-clustercd devtron-labs 0.10.2

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-operatordevtron-labs0.23.31 of 11See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
no fix listed

Open the chart page →

13,450
apid-helpergkarthiks0.1.41 of 1See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
no fix listed

Open the chart page →

2,607
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed

Open the chart page →

1,334
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.10

Open the chart page →

535
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

25,934
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

68,240
devtron-in-clustercdromholdings0.10.21 of 2See more

devtron-in-clustercd romholdings 0.10.2

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed

Open the chart page →

5,039
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed

Open the chart page →

32,902
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed

Open the chart page →

2,620
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
no fix listed

Open the chart page →

2,314
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed

Open the chart page →

6,671
argocd-operatorstatcan0.5.01 of 1See more

argocd-operator statcan 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-45738.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
no fix listed

Open the chart page →

1,985

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
github.com/argoproj/argo-cd/v2@v2.14.20
no fix listed
3
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/argoproj/argo-cd/v2@v2.7.2
no fix listed
3
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
2
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/argoproj/argo-cd/v2@v2.13.3
no fix listed
1
ryuunosukeds3/orbital:latest0879f7261b10
github.com/argoproj/argo-cd/v2@v2.14.11
no fix listed
1
sikalabs/slu:v0.72.07bd267f30247
github.com/argoproj/argo-cd/v2@v2.9.3
no fix listed
1
stakater/workshop-operator:v0.0.3897bf456cc97c
github.com/argoproj/argo-cd@v1.5.8
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
github.com/argoproj/argo-cd/v2@v2.14.9
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
github.com/argoproj/argo-cd/v3@v3.3.7
3.3.10
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
github.com/argoproj/argo-cd/v3@v3.1.2
3.2.12
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/argoproj/argo-cd/v2@v2.4.11
no fix listed
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/argoproj/argo-cd/v3@v3.0.3
3.2.12
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/argoproj/argo-cd/v3@v3.1.1
3.2.12
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/argoproj/argo-cd/v2@v2.8.6
no fix listed
1
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
github.com/argoproj/argo-cd/v2@v2.4.7
no fix listed
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/argoproj/argo-cd/v3@v3.0.5
3.2.12
1
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/argoproj/argo-cd/v2@v2.7.8
no fix listed
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/argoproj/argo-cd/v2@v2.8.16
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.