NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2025-13888: OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

criticalCVSS 3.1 9.1GHSA-pcqx-8qww-7f4v

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

Published Dec 15, 2025 · Updated Jan 22, 2026

Affected packages

github.com/redhat-developer/gitops-operator

Ecosystem
Go
Affected
< 1.16.2
Fixed in
1.16.2
Check
go list -m github.com/redhat-developer/gitops-operator

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology