Is CVE-2026-6388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6388 being exploited in the wild.

How severe is CVE-2026-6388?

Critical severity, with a CVSS score of 9.1, published 15 April 2026.

Which products and versions are affected?

Argo Project ArgoCD Image Updater; Red Hat Red Hat OpenShift GitOps < 1.19.2.

Is there a fix for CVE-2026-6388?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6388 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6388?

Check whether you run Argo Project Argo CD Image Updater. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6388: ArgoCD Image Updater cross-namespace privilege escalation

Q: Is there a fix for CVE-2026-6388?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-6388 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-6388?

Check whether you run Argo Project Argo CD Image Updater. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6388 · Severity: critical · CVSS 9.1 · Published 2026-04-15

A security flaw in ArgoCD Image Updater allows users with limited permissions to bypass security boundaries in multi-tenant environments. This tool is used to automatically update container images in Kubernetes clusters. An attacker could exploit this to force unauthorized software updates on applications belonging to other teams or departments, potentially compromising the integrity of critical business services.

Vendors: Argo Project.

Quick answers

Is CVE-2026-6388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6388 being exploited in the wild.
How severe is CVE-2026-6388?: Critical severity, with a CVSS score of 9.1, published 15 April 2026.
Which products and versions are affected?: Argo Project ArgoCD Image Updater; Red Hat Red Hat OpenShift GitOps < 1.19.2.
Is there a fix for CVE-2026-6388?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6388 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6388?: Check whether you run Argo Project Argo CD Image Updater. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-namespace privilege escalation vulnerability exists in ArgoCD Image Updater due to insufficient validation of namespace boundaries (CWE-1220). In multi-tenant environments where the controller operates with broad cluster-level permissions, an attacker with local network access and the ability to create or modify ImageUpdater resources can bypass isolation. By exploiting this lack of granularity in access control, the attacker can trigger unauthorized image updates on applications managed by other tenants. This vulnerability affects Red Hat OpenShift GitOps versions prior to v1.19.2. Remediation involves upgrading to a patched version or restricting controller permissions to specific designated namespaces.

Affected products

Argo Project ArgoCD Image Updater
Red Hat Red Hat OpenShift GitOps < 1.19.2

Timeline

2026-04-15: disclosed
2026-04-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.