Executive brief
A security flaw in the OpenShift GitOps operator allows a restricted user to delete critical system-wide permissions. By creating a naming conflict, a smaller, localized instance of the software can trigger the removal of security roles used by the main cluster-wide instance. This can lead to a denial of service where automated deployment processes or administrative functions lose the permissions they need to operate.
Technical details
A flaw exists in the ReconcilerHook function within the OpenShift GitOps operator's ClusterRole reconciler. The component fails to perform an 'allowedNamespace' check or validate resource ownership when reconciling ClusterRole objects. An attacker with low privileges in a specific namespace can craft a name collision between a namespace-scoped Argo CD instance and a cluster-scoped instance. This triggers the reconciler's delete logic, allowing the unauthorized deletion of ClusterRoles, leading to a denial of service. While some privilege escalation paths may be mitigated by external gates in the argocd-operator, the DoS vector remains a primary concern.
Affected products
- Red Hat OpenShift GitOps 1
Timeline
- 2026-06-04: other: Vulnerability reported to Red Hat Bugzilla
- 2026-07-15: disclosed: CVE published to NVD dataset