GO-2025-4242

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator

At a glance

Published: 2025-12-22 18:15 UTC
Updated: 2026-03-03 04:57 UTC
CVE: CVE-2025-13888
Aliases: GHSA-pcqx-8qww-7f4v

Description

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator

Affected packages

Package	Versions
Go · github.com/redhat-developer/gitops-operator	introduced 0

References

https://github.com/advisories/GHSA-pcqx-8qww-7f4v ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-13888 ADVISORY
https://access.redhat.com/errata/RHSA-2025:23203 WEB
https://access.redhat.com/errata/RHSA-2025:23206 WEB
https://access.redhat.com/errata/RHSA-2025:23207 WEB
https://access.redhat.com/security/cve/CVE-2025-13888 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2418361 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database