Loading vulnerability…
Privilege escalation via ArgoCD Custom Resources in OpenShift GitOps
A privilege-escalation flaw in OpenShift GitOps where a namespace administrator can create crafted ArgoCD Custom Resources (CRs) that cause the system to grant elevated permissions in other namespaces, including privileged namespaces. With these cross-namespace elevated permissions, an authenticated attacker can create privileged workloads that can be scheduled onto master nodes, leading to effective root-level control of the entire OpenShift cluster.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables cluster takeover: the attacker can escalate from namespace-admin scope to elevated permissions in privileged namespaces, create privileged workloads on master nodes, and obtain root-equivalent access across the cluster, compromising confidentiality, integrity, and availability of the OpenShift environment.
If you can’t patch tonight, do this now.
Until patched, restrict who can create/modify ArgoCD Custom Resources (CRs) and reduce namespace-admin capabilities where OpenShift GitOps/ArgoCD CRDs are present. Apply stricter RBAC and/or admission controls to prevent untrusted users from creating ArgoCD CRs that could result in cross-namespace privilege grants, and monitor for suspicious creation of privileged workloads (especially those targeting master nodes).
Patch, then assume compromise.
Upgrade OpenShift GitOps / the Red Hat gitops-operator package to a fixed release (noted in the provided advisory as 1.16.2 or later). Follow Red Hat advisories (e.g., RHSA-2025:23203) for the exact patched versions applicable to your deployment.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.