CVE-2025-13888

Critical CVSS: 9.1

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

Vendor

Product

CWE

CWE-266

Yayın Tarihi

2025-12-15 16:15:50

Güncelleme

2026-01-22 16:16:06

Source Identifier

secalert@redhat.com

KEV Date Added

Kategoriler

CWE-266 CRITICAL 2025

Referanslar

https://access.redhat.com/errata/RHSA-2025:23203 https://access.redhat.com/errata/RHSA-2025:23206 https://access.redhat.com/errata/RHSA-2025:23207 https://access.redhat.com/errata/RHSA-2026:1017 https://access.redhat.com/security/cve/CVE-2025-13888 https://bugzilla.redhat.com/show_bug.cgi?id=2418361 https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef https://github.com/redhat-developer/gitops-operator/pull/897 https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2