Executive brief
A security flaw in the Red Hat OpenShift GitOps Operator could allow a user with high privileges in a specific project to interfere with the entire cluster's monitoring system. By exploiting an incorrect security label applied to namespaces, an attacker could create rogue monitoring rules that affect the whole platform. This could lead to false alerts, hidden system issues, or a complete disruption of the cluster's operational visibility.
Technical details
A vulnerability classified as CWE-668 (Exposure of Resource to Wrong Sphere) exists in the OpenShift GitOps Operator. The operator incorrectly applies the 'openshift.io/cluster-monitoring' label to all namespaces where an ArgoCD Custom Resource (CR) is deployed. This label signals the cluster's monitoring stack to process PrometheusRule objects within that namespace. A local attacker with high privileges (PR:H) within such a namespace can create malicious PrometheusRules that are then propagated cluster-wide (Scope Change). This can be used to disrupt the platform monitoring stack or cause a denial of service for alerting systems. The issue is addressed in version 1.16.2.
Affected products
- Red Hat GitOps Operator < 1.16.2
Timeline
- 2025-01-28: advisory
- 2025-01-28: disclosed
- 2025-01-28: patched