PT-2025-51238 · Red Hat+1 · Openshift Gitops+1

Anand Kumar Singh + 1 · Published 2025-12-15 · Updated 2026-01-22 · CVE-2025-13888

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenShift GitOps (affected versions not specified)

Description A security issue exists in OpenShift GitOps where namespace administrators can create malicious ArgoCD Custom Resources (CRs). These CRs can deceive the system into granting the administrators elevated permissions in other namespaces, including those with privileged access. A successful exploit allows an attacker to create privileged workloads on master nodes, potentially resulting in root access to the entire cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-13888

GHSA-PCQX-8QWW-7F4V

GO-2025-4242

SUSE-SU-2026:0037-1

Affected Products

Argo Cd

Openshift Gitops

References · 103

• https://access.redhat.com/errata/RHSA-2025:23203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13888 · Security Note
• https://access.redhat.com/errata/RHSA-2025:23206 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:1017 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pcqx-8qww-7f4v · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23207 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13888 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4242 · Vendor Advisory
• https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef · Note
• https://github.com/redhat-developer/gitops-operator/releases/tag/v1.16.2 · Note
• https://github.com/redhat-developer/gitops-operator · Note
• https://github.com/redhat-developer/gitops-operator/pull/897 · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note