CVE-2025-13888
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs
A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
gitops-operator
- Vendor
- redhat-developer
- Product
- gitops-operator
- Platforms
- Unknown
- Default status
unaffected- Package
- gitops-operator
- Package collection
- https://github.com/redhat-developer/gitops-operator
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 1.16.2 | Unavailable | None listed |
Red Hat OpenShift GitOps 1.16
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.16
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift GitOps 1.17
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.17
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1 | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift GitOps 1.18
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.18
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift GitOps 1.18
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps 1.18
- Platforms
- Unknown
- Default status
affected- Package
- openshift-gitops-1/gitops-rhel8-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300 | unaffected | rpm | * | Unavailable | None listed |
Red Hat OpenShift GitOps
- Vendor
- Red Hat
- Product
- Red Hat OpenShift GitOps
- Platforms
- Unknown
- Default status
unaffected- Package
- openshift-gitops-1/gitops-operator-bundle
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.