CVE-2026-14251 Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collisio...

CVE-2026-14251

The CVE-2026-14251 entry concerns the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects, enabling a namespace-scoped Argo CD instance to delete a ClusterRole owned by a cluster-scoped Argo CD instance via a crafted name...

Improper Authorization

github.com/redhat-developer/gitops-operator is vulnerable to improper authorization. The vulnerability is due to insufficient validation of ArgoCD Custom Resources created by namespace administrators, which allows an authenticated attacker to escalate privileges across namespaces and deploy...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update

Important: Red Hat OpenShift GitOps v1.17.4 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-8231 CVE-2025-47913 openshift-gitops-1/argocd-agent-rhel8: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSHAGENTSUCCESS...

GO-2025-4242 OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator...

EUVD-2025-0134

Malicious code in bioql PyPI...

CVE-2024-13484 Openshift-gitops-operator-container: namespace isolation break

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the...

PT-2025-2188

Name of the Vulnerable Software and Affected Versions openshift-gitops-operator-container affected versions not specified ArgoCD affected versions not specified Description A flaw was found in the software, allowing a namespace to create a rogue PrometheusRule when the...